fd797941fcb5146004ebe7a52f231e80N[.]exe | Triage

Sharing

General

Target

fd797941fcb5146004ebe7a52f231e80N.exe
Size

2.5MB
MD5

fd797941fcb5146004ebe7a52f231e80
SHA1

d645c719248c022d3e1f5f3b52e153803dbc4fd4
SHA256

461d04259e756533f189bd3d8a44da9f754440c690188e5967f50b211f736a43
SHA512

62b66a66cc785e77c374186999b2c5b72a809b6b2a27a675f1c13232df09f73eca76a187d3cf49645b7a7f4f8260008b1ad489a9e4b739102fe9a37eeb56742f
SSDEEP

49152:XPi8+vofGkOOJbCx52SKE20NSeyNGoYdJ3citg1oudIow/3bwa:X+tCK52SvBw/NGjJEoudIHzN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd797941fcb5146004ebe7a52f231e80N.exe

Files

fd797941fcb5146004ebe7a52f231e80N.exe
.dll windows:5 windows x86 arch:x86

2f11c9141abac31acaf96817d2523272

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcstol

msvfw32

DrawDibGetPalette

user32

GetCapture
CopyImage
GetMessageA

oleaut32

SafeArrayCreate
SysAllocStringLen

rpcrt4

RpcAsyncGetCallStatus

esent

JetUpdate

shlwapi

PathAddBackslashW

advapi32

RegNotifyChangeKeyValue

kernel32

GetModuleFileNameA
PrepareTape
SetStdHandle
GetModuleHandleW
GetUserDefaultLCID
IsProcessorFeaturePresent
SetEvent
LoadLibraryExA
OpenFileMappingA

ole32

OleSetMenuDescriptor
CoLockObjectExternal
OleCreateFromData

Exports

Exports

UdvllnaagMelttdija

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 272KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ