208f372a54195b651cbef04cdff90bf19c311fdf5d8b0a67d2ea88ea03ff7637N | Triage

Sharing

General

Target

208f372a54195b651cbef04cdff90bf19c311fdf5d8b0a67d2ea88ea03ff7637N
Size

35KB
MD5

167696df2d30a8e0633dca815968aee0
SHA1

f57908274fcff6290644ee561fce5073c4f1d757
SHA256

208f372a54195b651cbef04cdff90bf19c311fdf5d8b0a67d2ea88ea03ff7637
SHA512

e9bda73c543597ba860ad49eb3aa031048e2f2434120de48e0b8a198372b038ebb995da2c3f2962ff4378cc5d7c80150c6f160896aaba180b3e68ba114866838
SSDEEP

768:T6zA4hZBsEcX6FPwls9d2YVyAxx0DaNdpTiAt4BHZ+:GzA4h7sJqwa9d2Y0TDaNPTt4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
208f372a54195b651cbef04cdff90bf19c311fdf5d8b0a67d2ea88ea03ff7637N

Files

208f372a54195b651cbef04cdff90bf19c311fdf5d8b0a67d2ea88ea03ff7637N
.exe windows:5 windows x86 arch:x86

3e9e24392871e52ba7484f21e0afc58f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

N:\ycbLflj\dhCxoktVsFz\gxzEetcE\nmMnqnQOmAqI\hCcyJabylnis.pdb

Imports

shlwapi

ord158

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
atol
_amsg_exit
_initterm
strspn
sprintf
clearerr
_ismbblead
_XcptFilter
_exit
_cexit
__setusermatherr
__getmainargs

kernel32

GlobalLock
CreateThread
CreatePipe
GetModuleFileNameA
ExitThread
GetModuleHandleA
Sleep
LoadLibraryW

gdi32

GetTextExtentExPointW
EnumFontFamiliesExW
CreateHalftonePalette
GetNearestPaletteIndex
CreateHatchBrush
CreateEllipticRgnIndirect

user32

SetScrollInfo
SetRectEmpty
GetWindowPlacement
GetShellWindow
wsprintfA
LoadIconA
IsDialogMessageA

Exports

Exports

?CreateDlgMessage@@YGHPAXPADK|U

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE