dc361d0daa25d13567130a6161582980_exe32[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dc361d0daa25d13567130a6161582980_exe32.exe
Size

66KB
MD5

dc361d0daa25d13567130a6161582980
SHA1

7c3181f608d759a42f2b5562dc2d2a47a526add6
SHA256

41fa8efa1ed578e1cbf8f60fdf7eea2f18ba501eaa795617588cdb4bb6f46e2b
SHA512

2edcab2ec0f4939f3b5f05f1324d7cffa7c5f35409305a4eeeac00c41a9c4de09559c9f6a4fbfbe0f861b8b8255924daa273951b6c8c1e3b23d73d76cd3a545b
SSDEEP

1536:bOaHbJCGg5237epydfluHlFZMkWhXAk4iklu6p1sHg3lza:br7JCdBpyplZrEuzH+za

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc361d0daa25d13567130a6161582980_exe32.exe

Files

dc361d0daa25d13567130a6161582980_exe32.exe
.exe windows:4 windows x86

8857e6cdb94140dfd76a63e3c7f87174

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetGeoInfoEx
GetNamedPipeInfo
QueryActCtxSettingsW
WriteConsoleOutputAttribute
EnumSystemLocalesA
TermsrvCreateRegEntry
Toolhelp32ReadProcessMemory
SetCurrentDirectoryA
QuirkIsEnabledWorker
lstrcmpiA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE