ed48474f8d4d9a9976f9f184bd1edcfb13d5bcb487c422b9042eef2ba17238daN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed48474f8d4d9a9976f9f184bd1edcfb13d5bcb487c422b9042eef2ba17238daN
Size

186KB
MD5

01eb2410573a7a5e3c591fa635c17010
SHA1

1c37d346af3928c940c4bfbbc473ada853fd7a9c
SHA256

ed48474f8d4d9a9976f9f184bd1edcfb13d5bcb487c422b9042eef2ba17238da
SHA512

2ad20e15b86c15d71937ac37c4cf961e3b62a2e349c14f9544dc068cf5a27e1f5c6e153e659b4562e16fccfbabda7cc851b481572f779b3501689f5c04960d8e
SSDEEP

3072:ef9/jpnpxUuAWssKsW8eZs0vWyi7qrLd4KCWokMN+XWcLRFCh+Rz7NdO3rJRWlj:efNGuAbsy3ZXuyiurLPo+fLRFCh+Rz7t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed48474f8d4d9a9976f9f184bd1edcfb13d5bcb487c422b9042eef2ba17238daN

Files

ed48474f8d4d9a9976f9f184bd1edcfb13d5bcb487c422b9042eef2ba17238daN
.exe windows:5 windows x86 arch:x86

c5ef63500fa7811324e90c261bdbd8b8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Return\File\Allow\Execute.exe

Imports

msvcrt

_controlfp
printf
__set_app_type
__p__fmode
free
fprintf
__p__commode
_amsg_exit
iswspace
_initterm
isxdigit
_ismbblead
_XcptFilter
_exit
_cexit
__setusermatherr
__getmainargs
mktime

kernel32

GetTempFileNameA
GlobalSize
GlobalAddAtomA
WaitForMultipleObjects
EnumResourceNamesW
LocalFree
MulDiv
OpenFile
VerifyVersionInfoW
CreateFileA
SetupComm
GetFileTime

Exports

Exports

_SendMessageASendMessageA@0
_SendMessageASendMessageASendMessageASendMessageA@0

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ