5b3736d71e49aeced1166184c9336ebd3c391c93c30624030cea41835f96649b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b3736d71e49aeced1166184c9336ebd3c391c93c30624030cea41835f96649b
Size

132KB
MD5

830757a934aeae76df190e70af82c0b5
SHA1

2656a1cca4e8c5805f9fb6affe6e78927054648e
SHA256

5b3736d71e49aeced1166184c9336ebd3c391c93c30624030cea41835f96649b
SHA512

575e57ed26cedad491191112c9d4ef157fa8cdf9ed8e3bec7fc777259686476e136be26cc0d6c377f192ca91f56810b20fab207e905193a6554a1c2b043d4f4c
SSDEEP

768:T8UZO58Pwr1UEp6IFzV3V8kgZXmjlX+ZMgFBVntvoZsNJrejP:ISP+3p7zlSNHMERv/rejP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b3736d71e49aeced1166184c9336ebd3c391c93c30624030cea41835f96649b

Files

5b3736d71e49aeced1166184c9336ebd3c391c93c30624030cea41835f96649b
.exe windows:4 windows x86 arch:x86

e93297b39dff55b1ec54bc385dcd36a2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
HeapFree
LoadLibraryA
Sleep
GetCurrentThreadId
GetStartupInfoA
GetProcAddress

user32

GetInputState
GetMessageA
PostThreadMessageA

mfc42

ord533
ord5194
ord798
ord1997
ord6407

msvcrt

_controlfp
remove
fclose
fscanf
fopen
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_itoa

Exports

Exports

s_284545

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ