155a361db84e8de4742b92b7b9e75476 | Triage

Sharing

General

Target

155a361db84e8de4742b92b7b9e75476
Size

192KB
MD5

155a361db84e8de4742b92b7b9e75476
SHA1

b9bb822efc1a17514a43c7d2938e08175296edc2
SHA256

c643676bca03a71463f3a92a78f895c93a5a46e67d3f26c4cde507c4b26c01cb
SHA512

6d701e76715498da01232d08b9321d1262152f4e4e42799792b0ad22883ae9c6f17674cc4be26f575847271f098b56a9329144c8a4e86e1fccad493757f51b79
SSDEEP

3072:wiws3ZT6xGp79vKXdHXRzXf0WRPDxK7ZaIcE8epV9b9r6oafOJ:MuROGidHXVXf0WVDgFOZ0V9b9iW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
155a361db84e8de4742b92b7b9e75476

Files

155a361db84e8de4742b92b7b9e75476
.exe windows:4 windows x86 arch:x86

87126b8cff212c4f870c2b5fd441b55a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA
SHEnumValueA
SHDeleteValueA
PathGetCharTypeA

advapi32

RegDeleteKeyA
RegEnumKeyExA
GetUserNameA

kernel32

GetModuleHandleW
GetCommandLineW
GetLastError
VirtualAlloc
LoadLibraryExA
IsBadHugeReadPtr
GetModuleHandleA
GetOEMCP
lstrlenW
ExitThread
IsBadReadPtr
GetProcAddress
ExitProcess
GetCommandLineA

Sections

.text
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ