d9c406404e174a0551c45b0f6d7b859a81eab9833d4c7e3d2becff8967057168 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9c406404e174a0551c45b0f6d7b859a81eab9833d4c7e3d2becff8967057168
Size

6KB
MD5

0197d9e6b920370b93fffdafabe19983
SHA1

d28591d940a618ddc6b7b129451d91cfcd160b1f
SHA256

d9c406404e174a0551c45b0f6d7b859a81eab9833d4c7e3d2becff8967057168
SHA512

c5c6c9bfc621363a025699d58f702d2c18c820f9618cec5873ea314d5d1132c6e14c902c01dd65d7e781fd7d8c94a2e2995c619c5f4dde806577df46e556e608
SSDEEP

48:S4bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uFv:t0mIGnFc/38+N4ZHJWSY9FI5Wqjx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9c406404e174a0551c45b0f6d7b859a81eab9833d4c7e3d2becff8967057168

Files

d9c406404e174a0551c45b0f6d7b859a81eab9833d4c7e3d2becff8967057168
.exe windows x64

7c5f9b19847a4e36080308f0e2c5add5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CloseHandle
VirtualFree
GetProcessHeap
CreateFileMappingW
MapViewOfFile
OpenProcess
UnmapViewOfFile
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ