ce80efc7ef9844ffd487e1e9ccb8b100N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce80efc7ef9844ffd487e1e9ccb8b100N
Size

42KB
MD5

ce80efc7ef9844ffd487e1e9ccb8b100
SHA1

f75941104af2e96602956e3da7f64cb64fa18237
SHA256

ff6dbd29f08abe56a4fda26b4d00c853b032a6ad35620b1f681713e2743e5a86
SHA512

c22c97625385c25a4ac2585e3ff75fc56265b2f3210d2c6f6ca6c10e42c36c69ccebd71d3072638a5467f6c339f3672b12d69556d159aca3cca207d9aca94a72
SSDEEP

768:q5vehS9XTPAh7M1Ren6KwYruH0M8JYF/Pluk59DqcU9luMJY4Bd:qtiGjoh7M1RenVfruHB8KFXluUqduM+6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce80efc7ef9844ffd487e1e9ccb8b100N

Files

ce80efc7ef9844ffd487e1e9ccb8b100N
.exe windows:5 windows x86 arch:x86

fdce2b869ccee4e6dadcdc6c0f6f6da8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA

kernel32

IsDebuggerPresent
TerminateProcess
UnhandledExceptionFilter
GetLastError
InterlockedDecrement
SetUnhandledExceptionFilter
CloseHandle
lstrcmpiA
CreateProcessA
CompareStringA
GetVersion
ExitProcess
LocalFree
FormatMessageA
ReadFile
CreateFileA
VirtualAlloc
GetModuleHandleA
GetCurrentProcess

user32

GetWindowRect
GetWindow
GetParent
MessageBoxA
wsprintfA
GetClientRect

ole32

CoCreateInstance
CLSIDFromString
CoUninitialize
CoTaskMemRealloc
CoInitialize
StringFromGUID2

oleaut32

LoadRegTypeLi
LoadTypeLi

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ