401a2a8e4351704ea41024d24976e78d6b19430eac5a17ebff76c979d5def94e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

401a2a8e4351704ea41024d24976e78d6b19430eac5a17ebff76c979d5def94e
Size

20KB
MD5

5f9c89745439409c7cf3dedb1697c14f
SHA1

0ef7398940a39ada4500d9d1a27c589916e7ea68
SHA256

401a2a8e4351704ea41024d24976e78d6b19430eac5a17ebff76c979d5def94e
SHA512

168bd66e66e3601471def94cc81ac9ba686de470fc150042659e42f464f0601d145d986cdf7b5bf3e300ae5e90f0f59de46ff00c2464274bcad6049b006694eb
SSDEEP

384:6HHoOOByHj0wxfCbKlCvw2XTtPA86NdU7xkWn+Z4nBr:CIOVjxfCbKAZP8Nmlo+N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
401a2a8e4351704ea41024d24976e78d6b19430eac5a17ebff76c979d5def94e

Files

401a2a8e4351704ea41024d24976e78d6b19430eac5a17ebff76c979d5def94e
.exe windows x86

c49980d2bb3e6d3ae4771de8dc1b48bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
IsWow64Process
GetCurrentProcess
GetCommandLineW
OpenProcess
GetLastError
DuplicateHandle
GetVersionExW
CreateFileW
CreateFileMappingW
MapViewOfFile
VirtualQuery
UnmapViewOfFile
CloseHandle
OpenFileMappingW
SetEvent
GetFileSizeEx
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
LoadLibraryW

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ