f1a9debb431a3fa3baf5182d7f9901f20b3026ae3f5ec0038fb6b4439c038a29 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1a9debb431a3fa3baf5182d7f9901f20b3026ae3f5ec0038fb6b4439c038a29
Size

736KB
MD5

8e36e0422a554d813e9f66b19aa06d41
SHA1

c8851bb1b33a8b485c43d0cc3014612ecc3798fc
SHA256

f1a9debb431a3fa3baf5182d7f9901f20b3026ae3f5ec0038fb6b4439c038a29
SHA512

88aa52623798060207d6732fc8938535bdaf94d3764c5650a04a48bae833eabe06238ab01e138730c906179c7ee585746a10a0fb9880156f6f8a0fc5f037e125
SSDEEP

12288:mfxcvhHmnMHSUz4Xdj6/zhsqTSmI1GXZmuU6nNp3UPWvMLNAR8mDSnzj8IF8R+dq:AE9mnMyaSdjUh5Sm8GXZnEPW0RARTSn6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WinRAR.KeyGen.exe

Files

f1a9debb431a3fa3baf5182d7f9901f20b3026ae3f5ec0038fb6b4439c038a29
.zip
WinRAR.KeyGen.exe
.exe windows:4 windows x86 arch:x86

0640cc6d187cacfa88ab2e66355dbd82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

RegOpenKeyW

comctl32

InitCommonControlsEx

comdlg32

GetSaveFileNameW

gdi32

Escape

oleaut32

VariantChangeType

shlwapi

PathAppendW

user32

GetDC

winspool.drv

OpenPrinterW

Sections

.MPRESS1
Size: 95KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rarreg.key
rarreg.key.ico
图文教程.docx
.docx office2007
教程.txt
.rar
.rar
将rarreg.key文件拖进来即可.txt