1db702102c7e47922d817bbaba4be090[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1db702102c7e47922d817bbaba4be090.exe
Size

119KB
MD5

1db702102c7e47922d817bbaba4be090
SHA1

146a59e82ce77266255c1a5d1a48b0bfff38d939
SHA256

0cac356ad337db2c02f9a61f6c6c40f3bd11f3a20f09bace1e16299b3f4a7683
SHA512

072c352fdc7f09146b58133795df489d24c6a38c02152418d99fcbc36d94666e24a336d7bbec6669b5ed601b6154fef2d9169cea932b309265a3118733c1ed14
SSDEEP

3072:DeISmmYmcOZa7NIhL1cQerV66sMkpy2Q3TIc:6IS5g7AL1cQ7p3Q3Tn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1db702102c7e47922d817bbaba4be090.exe

Files

1db702102c7e47922d817bbaba4be090.exe
.exe windows:4 windows x86 arch:x86

049a8f92f04969a51d92509beaf9d654

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
SetHandleContext
ClosePrivateNamespace
GetTapePosition
QueryIdleProcessorCycleTimeEx
GetFileInformationByHandleEx
WerGetFlagsWorker
lstrcpyA
GetApplicationRestartSettingsWorker
DisableThreadLibraryCalls

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE