896b82c757ed9a91b28b53f6e4038193902aa8344444bb27f5a9af2d8eb2ecfb | Triage

Sharing

General

Target

896b82c757ed9a91b28b53f6e4038193902aa8344444bb27f5a9af2d8eb2ecfb
Size

171KB
MD5

290f1aec6b94569b8020652419b482e2
SHA1

d2f3ba897acae692c7cb1c6fba46810fc3b61045
SHA256

896b82c757ed9a91b28b53f6e4038193902aa8344444bb27f5a9af2d8eb2ecfb
SHA512

76d06bdd4644f65817c978f1c7c7c48e684472948297bcd31546ec8ab6dad47b15f5797af55cc9271aa2ad38b635932848ce79888d6ce48699520a3fcc43dbbf
SSDEEP

1536:s9SsmEuUQ0/Siir+jJuCGEvkznmP+upxEJcoLN4LZ8BSaPXDelY:uT/NbGEv8mWupxEKoBuiB/XD+Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
896b82c757ed9a91b28b53f6e4038193902aa8344444bb27f5a9af2d8eb2ecfb

Files

896b82c757ed9a91b28b53f6e4038193902aa8344444bb27f5a9af2d8eb2ecfb
.exe windows:4 windows x86 arch:x86

b52f1898b4b003f762f5b9c03e005e8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA
GetClassNameA
IsWindowVisible
GetAsyncKeyState
GetWindow
GetWindowThreadProcessId

kernel32

ReadFile
LCMapStringA
LoadLibraryA
FreeLibrary
Sleep
GetLocalTime
GetStartupInfoA
CreateProcessA
OpenProcess
GetModuleHandleA
GetProcAddress
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
CloseHandle
WaitForSingleObject
GetExitCodeThread
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
Module32First
CreateThread
OpenEventA
CreateEventA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
WriteFile
GetFileSize
CreateFileA
MoveFileA
DeleteFileA

msvcrt

malloc
_CIfmod
_CIpow
strchr
realloc
memmove
__CxxFrameHandler
sprintf
strncpy
atoi
??3@YAXPAX@Z
strncmp
??2@YAPAXI@Z
modf
_ftol
free

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ