abb58ec5317f8fd0f9511abf869e13e279275a5ab95728181bfb019ab4d0240b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

abb58ec5317f8fd0f9511abf869e13e279275a5ab95728181bfb019ab4d0240b
Size

13.7MB
MD5

f0486cc462fa8f7bce6ac20b8fb0c4e1
SHA1

40f13bff5e502a7ddae3648bb2acbe41616e8fb1
SHA256

abb58ec5317f8fd0f9511abf869e13e279275a5ab95728181bfb019ab4d0240b
SHA512

0b2d3adf448ee01dc8327f31a9edfb52320fe3fcaf99e7cd39aaa790c6966cb43a0aaee6211b4ccffb5a32f43cc01786276fb94967a6059ee632ccdfaa5571f0
SSDEEP

393216:X9FapUhqenzBrLCV4aCEDDJ83a109XdwWFtNITaZWbsN7N:X6KdrLCHCEDlEaMtwetNLK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abb58ec5317f8fd0f9511abf869e13e279275a5ab95728181bfb019ab4d0240b

Files

abb58ec5317f8fd0f9511abf869e13e279275a5ab95728181bfb019ab4d0240b
.exe windows:6 windows x64 arch:x64

12b2bc20d7737a83639913d36501fd39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW

comctl32

ord380

kernel32

GetACP

advapi32

OpenProcessToken

gdi32

SelectObject

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

shell32

SHGetFolderPathW

Sections

.text
Size: 146KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
steamwork2.pyc