0c5838b5e26c50608d52fc24f7ab7840 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c5838b5e26c50608d52fc24f7ab7840
Size

1.6MB
MD5

0c5838b5e26c50608d52fc24f7ab7840
SHA1

0d6ffe4276ee8ff81881e812d1daf4fcb7a244b5
SHA256

e2090f9d113bfad5b17678c7acdb7edca247c36b630e2c956c6c6c3026356477
SHA512

ae4e3d2e3e61d855c39b3dcab4c98b031c5194255c539002ce96f49dcb4b51d9905627f622ff7755bdbfc4d6c46df39f0b571eb2c34ceb21127dfdeac8d86cbe
SSDEEP

24576:FgqwHiS3NxNYwLevcCGzGZzkl8PJAwfKndUCoXSoi4IYggpbuoIXKq:FgFCS3NxGKx8PDgdUTItbK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c5838b5e26c50608d52fc24f7ab7840

Files

0c5838b5e26c50608d52fc24f7ab7840
.exe windows:4 windows x86 arch:x86

a13ee2bd542e30b8d805240c3433d2bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32.dll.

CloseHandle
WriteFile
CreateFileA
DeleteFileA
lstrcpyA
lstrlenA
GetTempFileNameA
GetTempPathA
GlobalAlloc
ExitProcess
GetCommandLineA
GetModuleHandleA

shell32.dll.

ShellExecuteA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ