1f1614c2e3e2a5964f824efba116ed60N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1f1614c2e3e2a5964f824efba116ed60N.exe
Size

348KB
MD5

1f1614c2e3e2a5964f824efba116ed60
SHA1

7264b6e3e24d8467e37098ebeeb8fd295ff31d3b
SHA256

3e4b1178851672d5c1f80b9b5c4df57c8504bb9661e8ba9f417b58ce63f3a214
SHA512

41ec1af9e0e67ba716951a13ab898902b0bb0d116d0785e95d3b5406a9844f57ed7f2fcbc004626d7977e89b4399d753544c97da5e276b8d7f1b74b0cca2e670
SSDEEP

6144:so4rII5tXPGd89dXghBEF0JvoBltLtTMIPdtWlLOLXHV:orISwuQoBTpNPdtWVO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f1614c2e3e2a5964f824efba116ed60N.exe

Files

1f1614c2e3e2a5964f824efba116ed60N.exe
.dll .pdf windows:6 windows x86 arch:x86 polyglot

45409799ef67da619a0cc6f27dcde8e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\mso\x-none\exp_pdf.pdb

Imports

msvcr100

_invalid_parameter_noinfo_noreturn
memcpy
__CxxFrameHandler3
_CIsin
_CIcos
_vsnprintf_s
sprintf_s
_snprintf_s
memmove
wcsnlen
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
strncpy_s
strncat_s
strnlen
strcpy_s
wcsncpy_s
memset
rand

advapi32

CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptGetHashParam
CryptImportKey
CryptEncrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW

gdi32

DeleteObject
GetCharWidth32A
GetGlyphOutlineA
GetOutlineTextMetricsA
GetTextAlign
GetTextExtentPointA
GetGlyphIndicesW
GetCharWidthI
SelectObject
SetTextAlign
CombineTransform

gdiplus

GdipGetPointCount
GdipGetPathTypes
GdipGetPathPoints
GdipGetPathFillMode
GdipGetPathWorldBounds
GdipCreateMatrix3
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipGetMatrixElements
GdipDeleteMatrix

kernel32

GetProcessHeap
QueryPerformanceCounter
DisableThreadLibraryCalls
HeapSetInformation
GetTimeZoneInformation
FileTimeToSystemTime
MoveFileExW
GetLastError
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
VirtualProtect
WerRegisterMemoryBlock
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalAlloc
GetProcAddress
FreeLibrary
LoadLibraryA
WriteFile
DeleteFileW
CloseHandle
SetFilePointer
ReadFile
GetFileInformationByHandle
GetFileAttributesExW
RaiseException

rpcrt4

UuidCreate

mso

ord302
ord252
ord5276
ord4454
ord1530
ord7488
ord9730
ord9064
ord9584
ord5541
ord2766
ord7285
ord5467
ord3735
ord8953
ord3500
ord3786
ord491
ord2024
ord6705
ord4606
ord1133
ord7612
ord6125
ord9462
ord8879
ord3278
ord4602
ord9362

Exports

Exports

HrGetDocExDocument

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 247KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45409799ef67da619a0cc6f27dcde8e1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

advapi32

gdi32

gdiplus

kernel32

rpcrt4

mso

Exports

Exports

Sections

.text Size: 98KB - Virtual size: 97KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 247KB - Virtual size: 248KB

.text
Size: 98KB - Virtual size: 97KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 247KB - Virtual size: 248KB