ed4d227458d409e72e024dab3441c4da765d2c25a539002bf075297604c3fafd | Triage

Sharing

General

Target

ed4d227458d409e72e024dab3441c4da765d2c25a539002bf075297604c3fafd
Size

241KB
MD5

84eed196f61dbce11a4a861726226efd
SHA1

02f6fdfa86205fb9921eca9a810da4df8f0712e6
SHA256

ed4d227458d409e72e024dab3441c4da765d2c25a539002bf075297604c3fafd
SHA512

f5cbdd9c06b373bd8ad4419f19cf56f18270a15a2c066e9637ef43ff71ebc00b41b429f683d588ec21d3141dbd53d69c022ded903369a0c4b1cb90bbcbb6b7ba
SSDEEP

3072:RuUl6TDemSQblqSJnjMXd866xf+L1glMHaeavmZASopyriM3Y1nst6Cds:RuUlZmhI2MB1tHsmZfosrvY+QCK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed4d227458d409e72e024dab3441c4da765d2c25a539002bf075297604c3fafd

Files

ed4d227458d409e72e024dab3441c4da765d2c25a539002bf075297604c3fafd
.exe windows:6 windows x64 arch:x64

3d038da58dcc03d761a851caf1420778

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CopyFileA
CreateFileA
CreateFileMappingA
CreateProcessA
ExitProcess
FindResourceW
FreeLibrary
FreeResource
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetTempPathA
GetTickCount
GlobalMemoryStatusEx
HeapAlloc
HeapFree
IsBadReadPtr
LoadLibraryA
LoadResource
LockResource
SizeofResource
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WinExec
WriteFile
lstrlenA

user32

MessageBoxA
wsprintfA

api-ms-win-crt-string-l1-1-0

strlen

Exports

Exports

_memicmp

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ