68c0b8029a97da099f4336981f6aea03cd6ca3964cd317319f9a8cdab3191898 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68c0b8029a97da099f4336981f6aea03cd6ca3964cd317319f9a8cdab3191898
Size

4.7MB
MD5

f7c43abd861ee50321facaae0682d8bf
SHA1

01eb39be3134d4146dc9369993f8bc0ff354bb83
SHA256

68c0b8029a97da099f4336981f6aea03cd6ca3964cd317319f9a8cdab3191898
SHA512

9af5651364b38467ae27b0b5d1a8313fe062cd085fca47fceda086bba43b226de9aff11fd727d8d34372799b0cbfafd088fd9f8e356daff8c568e0c9de203e70
SSDEEP

98304:kf4EIDDHK9nhCbJzEaokXvLZw8jzcO/7KNQS8r7NL5j5tDo3STwK7zUFBVEWE7l+:Q4HKDQBKkXy+XWt815j5tDobSUFQR47n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68c0b8029a97da099f4336981f6aea03cd6ca3964cd317319f9a8cdab3191898

Files

68c0b8029a97da099f4336981f6aea03cd6ca3964cd317319f9a8cdab3191898
.exe windows:5 windows x86 arch:x86

f427ec01d51b9c584dcb332a494f35bf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueW

mpr

WNetGetConnectionA

ole32

CreateStreamOnHGlobal

comctl32

_TrackMouseEvent

shell32

ShellExecuteA

comdlg32

GetOpenFileNameA

wsock32

WSACleanup

gdiplus

GdipSetStringFormatLineAlign

Sections

.text
Size: 3.9MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE