212f2e7397c43b649084027ab0181888c7482775e233f617281ea13ec78050b0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

212f2e7397c43b649084027ab0181888c7482775e233f617281ea13ec78050b0
Size

55KB
MD5

7eb1e0d24dc59fb1a1417f49aefa7dad
SHA1

aadfa9a37e16f54f958fff67de271eb2b2f73b8b
SHA256

212f2e7397c43b649084027ab0181888c7482775e233f617281ea13ec78050b0
SHA512

00901708cd1c2c4b67ec864388f98cb028bf648a7c4ce4fd087fcdf57cc4f67dcfb3393a94e5224fe76914cb4b854ba8c9226cc11ab1146aa24169bacf072a90
SSDEEP

768:as7KzozFjaSftZynUyBTiI8PRxZ2vd+gQSBUdRln31apUAhFeI9C3/WGLd2jjxG4:VHcSFZ4UyD8zovd+gQZ/raCFI96U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
212f2e7397c43b649084027ab0181888c7482775e233f617281ea13ec78050b0

Files

212f2e7397c43b649084027ab0181888c7482775e233f617281ea13ec78050b0
.exe windows:4 windows x86 arch:x86

3a99dcaf86e001091e8ef445609c9e8c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA
MessageBoxW

kernel32

CloseHandle
LoadLibraryA
GetProcAddress
FreeLibrary
RtlMoveMemory
MultiByteToWideChar
CreateProcessW
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA

msvcrt

atoi
strchr
_strnicmp
strncmp

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 686B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE