89dd12ad4940675259249931dda95472faa76070e1d3c02f16bffbca2585bc94 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

89dd12ad4940675259249931dda95472faa76070e1d3c02f16bffbca2585bc94
Size

6KB
MD5

02ce88010fefa3de2d9e9d8483ea25ce
SHA1

993858792a117a698a09eed7e2ccb58d3800c5e0
SHA256

89dd12ad4940675259249931dda95472faa76070e1d3c02f16bffbca2585bc94
SHA512

6b60685382e2545d4ab36eda3e29c059c749ba982d50d5c4dcfc50d144ebb64dfefc6b7921006d84d30da0b59f0c96de20db9bd96b678cdb5fdc9ee6f10e58b3
SSDEEP

48:S4bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9ufX:90mIGnFc/38+N4ZHJWSY9FI5WqJx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89dd12ad4940675259249931dda95472faa76070e1d3c02f16bffbca2585bc94

Files

89dd12ad4940675259249931dda95472faa76070e1d3c02f16bffbca2585bc94
.exe windows x64

7c5f9b19847a4e36080308f0e2c5add5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CloseHandle
VirtualFree
GetProcessHeap
CreateFileMappingW
MapViewOfFile
OpenProcess
UnmapViewOfFile
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ