065cf1f1a3fd806523cc9d1a5600fc95 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

065cf1f1a3fd806523cc9d1a5600fc95
Size

119KB
MD5

065cf1f1a3fd806523cc9d1a5600fc95
SHA1

e53d9976da47dcc8221efa892e2c1784e45f5634
SHA256

bd278a9b044c3666bf862f6f94af69901a8c6ef9a99940bb473eaea50ee78b2d
SHA512

b2b329ad452c6c556044e95ef2fa0472455ae2d3d5877491924232fdde5332d09eca7c07ed990c0041a06f94ab5e533b59552e7a31a66e4d422ec3cad64f6824
SSDEEP

3072:V6y69qQU+g9GQGB9uGpmAhJ1r4bAAW3wtkSpZ:wy6LUD9G7mO1rBY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
065cf1f1a3fd806523cc9d1a5600fc95

Files

065cf1f1a3fd806523cc9d1a5600fc95
.exe windows:4 windows x86 arch:x86

5341d7efa587aaa838151ee827133f82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetCommandLineA
LoadLibraryA
ExitProcess
GetProcAddress
GetModuleHandleA
VirtualAlloc
IsBadReadPtr
GetModuleHandleW
GetOEMCP
GetACP
GetCommandLineW
ExitThread
GlobalFindAtomA
LoadLibraryExA

shlwapi

SHDeleteValueA
PathIsDirectoryA
SHQueryValueExA
SHEnumValueA
SHGetValueA

ole32

CoCreateGuid
CLSIDFromProgID
CreateBindCtx
CoUnmarshalInterface
StgCreateDocfileOnILockBytes
MkParseDisplayName
CreateStreamOnHGlobal
CLSIDFromString

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 819B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ