1c0611b86541b3e16052eaeedda50370[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c0611b86541b3e16052eaeedda50370.exe
Size

119KB
MD5

1c0611b86541b3e16052eaeedda50370
SHA1

88fe5b31d7ca2ab0e4788509abec2a274d631d54
SHA256

1bdc22f31e984f25d20c53c0b6f3e717fb701fdaa72cc048b3c1fd6efeff440c
SHA512

6e3e2b539bd42f0170d68adfec1db6f5bcdfceb76a7c87aa8a348c6ffb83a8f633f9175ed20eaa6ff5ef8fda930215ac880b2b0b5306d779ca19459bf7b05725
SSDEEP

3072:EsIhva5YLGkcoJBuk3YwI+xmjXrnK8W8fWgZ9aOt:Esaa5y7AwI+xmzggZ9aOt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c0611b86541b3e16052eaeedda50370.exe

Files

1c0611b86541b3e16052eaeedda50370.exe
.exe windows:4 windows x86 arch:x86

d9aec276a1751dae2db4c0e3e84664b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetGeoInfoEx
LocateXStateFeature
GetUserGeoID
PssWalkMarkerSeek
ActivateActCtx
SetConsoleTextAttribute
QueryThreadCycleTime
GetVolumeInformationByHandleW
GetComPlusPackageInstallStatus
QuirkIsEnabledWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE