cf72c50db784da3083abc99abec7f72055fee5343304902e48ee3964ed9777fb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf72c50db784da3083abc99abec7f72055fee5343304902e48ee3964ed9777fb
Size

48KB
MD5

16c54e45111627194e48fd4e524723e2
SHA1

df9f2de4a3abd038a4bf7ec31aedb8ad9be77176
SHA256

cf72c50db784da3083abc99abec7f72055fee5343304902e48ee3964ed9777fb
SHA512

3d6b7e4df30ab720722dec1ef534fb856f6fa016563c15c2329ed47f6791bf172b542f84b2cedc162e50f8acd89b020393583e3dad44e2d853207ffa3898461b
SSDEEP

768:MdAT05xk7HRU+pyimdIAhSreMzsiOhTN98Km/g:Yfk7H++pyi8IAgreMNOh5Gz/g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf72c50db784da3083abc99abec7f72055fee5343304902e48ee3964ed9777fb

Files

cf72c50db784da3083abc99abec7f72055fee5343304902e48ee3964ed9777fb
.exe windows:5 windows x86 arch:x86

d0b8285184365a838ba34f4f2ef57766

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetSetOptionW
HttpSendRequestW
InternetConnectW
InternetReadFile
HttpQueryInfoW
HttpOpenRequestW
InternetQueryOptionW
InternetOpenW

kernel32

HeapCreate
GetModuleFileNameW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
GetTempPathW
lstrlenW
lstrcmpW
ExitProcess
GetFileSize
HeapAlloc
GetModuleHandleW
WriteFile
ReadFile
CreateFileW

user32

wsprintfW

shell32

ShellExecuteW

Sections

.text
Size: 939B - Virtual size: 939B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ