MapKeyboard[.]2[.]1[.]zip | Triage

Sharing

General

Target

MapKeyboard.2.1.zip
Size

109KB
MD5

4727e80485687aea54a80f0458dfaa74
SHA1

f232e1dc5174909d28febc974a7bbda1ca46d0d3
SHA256

a267017d2b2305d8804ee693ae75b244e504208da8550aaf4cb29e3f876a1eef
SHA512

0676ec894adc8ff219b93ad2a4a350e07d86edcde47e60385952efbcd802d27d960704fb5545ba5af3f1fba5b3659a0a23805a74cb2ce4ac85de03205eaa8cfb
SSDEEP

3072:4pznPKTT+bH/LwbNn2ibRNdEUpnvCiG4n7rMlCGXp:W2v+3wZfbrnvb7rMlCmp

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MapKeyboard.2.1/MapKeyboard.exe

Files

MapKeyboard.2.1.zip
.zip
MapKeyboard.2.1/MapKeyboard.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MapKeyboard.2.1/readme.pdf
.pdf
- http://www.inchwest.com/mapkeyboard.htm