159a8e7ffa91a48f1a706f03b67bfdc94631558aa894ed22defd51d71fd1bab2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

159a8e7ffa91a48f1a706f03b67bfdc94631558aa894ed22defd51d71fd1bab2
Size

15.5MB
MD5

8508cf5dafa3b8db9e3a4c0c70662d71
SHA1

f2cae8525bc3d37098daf017cd002e6e07fed0db
SHA256

159a8e7ffa91a48f1a706f03b67bfdc94631558aa894ed22defd51d71fd1bab2
SHA512

7c06569ef1721565c3c9e0ddabd6797531ecc6f22439bee5629cd92ab2f9b2e6ad6924d300492d35a300c1d34e7c7b0a3f60cddd0c14e300d1c638aa382bc45b
SSDEEP

393216:Z4QXXBVT/XMAIB9NOfryT8XNELOf4nTCvhTqPtxoGC4GlMyKhx:Z4qkA+OfL8Of/vpYPo2ZT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
159a8e7ffa91a48f1a706f03b67bfdc94631558aa894ed22defd51d71fd1bab2

Files

159a8e7ffa91a48f1a706f03b67bfdc94631558aa894ed22defd51d71fd1bab2
.exe windows:4 windows x86 arch:x86

a6c39ea1e771a0880244dc044e984a42

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

winmm

midiStreamOut

ws2_32

socket

rasapi32

RasHangUpA

user32

GetKeyState

gdi32

LineTo

msimg32

GradientFill

winspool.drv

DocumentPropertiesA

advapi32

RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoGetClassObject

oleaut32

SysAllocStringLen

comctl32

ImageList_Draw

oledlg

ord8

wininet

InternetCanonicalizeUrlA

comdlg32

ChooseColorA

Sections

.text
Size: 2.2MB - Virtual size: 11.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

3dc1
Size: 960KB - Virtual size: 960KB