616673a9aa99dbe080505e784ee2102e9633ed17c0c384739709f13a925c2938 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

616673a9aa99dbe080505e784ee2102e9633ed17c0c384739709f13a925c2938
Size

1.6MB
MD5

ee0dfc3da09969b8efb1b454dc399d27
SHA1

f0c7d66b215c9459aaad706c7bff9430eef75696
SHA256

616673a9aa99dbe080505e784ee2102e9633ed17c0c384739709f13a925c2938
SHA512

b961bc6aa3a9ee09eb31b7e99137749c5da3da504185e13ccd00dab8fb9db3c897dac3645a955dc883dc56ca0a63261678b7193198560f198d4c7198497b9cec
SSDEEP

49152://z4BOeD85HBx66OPkoPlQGPR2FpA9ONuNudlHbtsGPeVbgw:3oOeD85HJOPv629Mndl5sTbgw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
616673a9aa99dbe080505e784ee2102e9633ed17c0c384739709f13a925c2938

Files

616673a9aa99dbe080505e784ee2102e9633ed17c0c384739709f13a925c2938
.exe windows:4 windows x86 arch:x86

107ff63f658d6feb25c073be45ea521d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime

user32

LoadIconA

gdi32

GetTextMetricsA

winmm

waveOutUnprepareHeader

winspool.drv

OpenPrinterA

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

CLSIDFromString

oleaut32

UnRegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

inet_ntoa

comdlg32

ChooseColorA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

Sections

.text
Size: 628KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sedata
Size: 980KB - Virtual size: 980KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ