036563c7a203013437fe6c76cef85cf3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

036563c7a203013437fe6c76cef85cf3
Size

18KB
MD5

036563c7a203013437fe6c76cef85cf3
SHA1

e943fe11a543616a196648962b88eeeffc7fd1f4
SHA256

6dc6975d80225c3186d1e18ea6ff1e91d26521ac60709145494d2f9658058423
SHA512

08b3024c7ca0f0825a1e7a833f1b068df2635742953f878e596e5259b217d7e0879321d2ebd44991fca474f36b492e53d113f94e1dc125d6c77892c76f50802a
SSDEEP

384:H17Mq91XU18HUNcQGZjWgnQv8Y3v5WMo/bwW:HtlDXU18HU+7ZjWqQv8Y3v+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
036563c7a203013437fe6c76cef85cf3

Files

036563c7a203013437fe6c76cef85cf3
.exe windows:4 windows x86 arch:x86

8c643aaa44015ce5afc32a08d5cf06e0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetEnvironmentVariableA
lstrcatA
lstrcpyA
GetShortPathNameA
GetModuleFileNameA
ExitProcess
CreateProcessA
GetStartupInfoA
GetWindowsDirectoryA
GetModuleHandleA

user32

CreateDesktopA

msvcrt

__p__commode
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
strcat
__p__fmode
__set_app_type
_except_handler3
_controlfp

shell32

ShellExecuteA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ