39cf6bbba11ca7d1348706a6f8dcba50N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39cf6bbba11ca7d1348706a6f8dcba50N
Size

1.5MB
MD5

39cf6bbba11ca7d1348706a6f8dcba50
SHA1

eba9bcc3301496b957bfd3e600c464822676cb3e
SHA256

ddfcc07fa7dfd806e1dc00034f364f175e370564274685494bc5d0445d5a0be2
SHA512

c75a3bfece675459ea960f7a80dde1a9595497cd2a61a4b22d8fcfb6c6133e4e2d01c6bd0f49b0307f0f50260fa6ed1e95be5f67ea455e44e47d26471129e4d9
SSDEEP

49152:dpdlghXgOVb8xtjkAz9U0XYRd0zb78N9hQsLXO:BlghHBAZgH0UhPO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39cf6bbba11ca7d1348706a6f8dcba50N

Files

39cf6bbba11ca7d1348706a6f8dcba50N
.exe windows:6 windows x86 arch:x86

b9180f94db9ea77f1a1c16e704bf8717

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

GetMessageW

shell32

ShellExecuteA

advapi32

RegSetValueExA

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1Q[
Size: - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.),E
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sc=
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ