162014ea1f2e8d27ddccb8bd4e468beb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

162014ea1f2e8d27ddccb8bd4e468beb
Size

81KB
MD5

162014ea1f2e8d27ddccb8bd4e468beb
SHA1

b6a2e14689e461a8ac6195bd7daa645e4e2fb410
SHA256

ca8f2265b78b2e04007780c461ba261db978d6e77fcc216f3d74ddc20b2e11ef
SHA512

3bc24f2e85b6069b9ecddc2dcff1e4769c73fbdd6edb2929a94df54d8797f8a10dcea9907ab3c5a3ef8fb07cd7b8a64650519b3eaf8708c913b2b254d497255b
SSDEEP

1536:6G5tUo8CuL3TbEarceHUcb7xiX5CdRhW96vfK7xptQZBy4HMr5t1PlFPLJ:6QaTbEarcU7xi4dRgOfKFoZByCMr5flj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
162014ea1f2e8d27ddccb8bd4e468beb

Files

162014ea1f2e8d27ddccb8bd4e468beb
.exe windows:5 windows x86 arch:x86

b43646fe5948e62bca4f3a9563c8ca89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ExitProcess
WriteConsoleOutputAttribute
VirtualProtect
GetModuleHandleA
GetStartupInfoA
GetModuleFileNameA

user32

GetUpdateRect
CloseWindowStation

Exports

Exports

Nwuqpgoip
Iflslkmsg
Cqustyjd
Ixhplnxir
Mruwvdpbeys
Mlsqhmq
BeginDxguhigbl
Shhpdtm

Sections

.text
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rcode
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata1
Size: 66KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrd
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ