81ea4c3a6754e3a5d632969b5ceb10353d669caa6fe37f6afa3d38e8e104b1aa | Triage

Sharing

General

Target

81ea4c3a6754e3a5d632969b5ceb10353d669caa6fe37f6afa3d38e8e104b1aa
Size

595KB
MD5

53129d1d70f76aefad9247887c17606a
SHA1

ab28597911efddd1f5a48a34e50c388f7cf22f3c
SHA256

81ea4c3a6754e3a5d632969b5ceb10353d669caa6fe37f6afa3d38e8e104b1aa
SHA512

b2f95d90cef40bed22d8231e2e6b3a6e8abb674b837ba5f61f8ef06f21712da3502ffb5d9c54eb5556fb8d97a9d16ce58adc561de5a9f9d83c3aa1085b89927e
SSDEEP

12288:BBBBvbRHFURgU2cZC7EQbMiDH9uAPCCaxspmYQ8ow5v3hbUF:BBvv1HkgU2mCYQ4iDH9YCaSpmeow5vx4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81ea4c3a6754e3a5d632969b5ceb10353d669caa6fe37f6afa3d38e8e104b1aa

Files

81ea4c3a6754e3a5d632969b5ceb10353d669caa6fe37f6afa3d38e8e104b1aa
.exe windows x64

Password: infected

7e5590227ad3aecb2feedda5da4da1cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateFileA
CloseHandle
GetLastError
CreateActCtxA
ActivateActCtx
DeactivateActCtx
GetFileAttributesA
LockFile
UnlockFile
SetFilePointer
OpenFileMappingA
CreateNamedPipeA
WaitNamedPipeA
ExitProcess
VirtualAlloc
GetDiskFreeSpaceA
GetDriveTypeA

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 270KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ