1226eb0bb2b544e7af5c74a9163b8026fcd15b0a3198ac54837aed3c1f2ca046 | Triage

Sharing

General

Target

1226eb0bb2b544e7af5c74a9163b8026fcd15b0a3198ac54837aed3c1f2ca046
Size

10.6MB
MD5

382673a03cd2bd479bc48600635766a1
SHA1

d8db24956a96dbb3c43e8ee86eac3950b7819c4b
SHA256

1226eb0bb2b544e7af5c74a9163b8026fcd15b0a3198ac54837aed3c1f2ca046
SHA512

8edec2f87985fe1036239a7bcd8b4ad0ffbe26c18a934d23c742e44968f990b3876cda139747768b3251a5ddda853c45ffeaec6978ecac83adfafae0418c3c1e
SSDEEP

196608:sgfAh1SVzNjWDVoTT42o9eoZTS2p6Db2pvNYV6OUrqBGa/50ZyqHM:sgA1AW8420nd1p6Db2pvQluaKUqs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1226eb0bb2b544e7af5c74a9163b8026fcd15b0a3198ac54837aed3c1f2ca046

Files

1226eb0bb2b544e7af5c74a9163b8026fcd15b0a3198ac54837aed3c1f2ca046
.exe windows:6 windows x64

f7c396a72d723894ff01e2b8eccc00ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualProtect
RtlAddFunctionTable
GetModuleHandleA
GetProcAddress
VirtualFree
VirtualAlloc
SizeofResource
FreeResource
LockResource
LoadResource
FindResourceW
ExitProcess
GetModuleHandleW
GetCommandLineW
LoadLibraryA
GetStartupInfoW

user32

DefWindowProcW
MessageBoxW

comctl32

InitCommonControlsEx

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code0
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10.6MB - Virtual size: 10.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ