0d1a5cb94fca1c7849ccf76591e686a7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d1a5cb94fca1c7849ccf76591e686a7
Size

97KB
MD5

0d1a5cb94fca1c7849ccf76591e686a7
SHA1

d771d4e8349c4d625eaead0f5aa2c1bd0884cba0
SHA256

57f30606805568d98b325e7f7429af1e334e954ba575f8d7b467d63eb4aeffdb
SHA512

7cd2dfd9866ea18ba8a59b89f0085536a9acfbe36e567b80d996e46fd519ac85b4583cd2a72efcdcee8e602f0562150ff145b0d673e9e5d3708564f08a058f3a
SSDEEP

1536:Z9uanYqpZZgGgT8/vy6DIdQCvvfVsFb4ou23Ic7qdujTL/ItIYl:Z9uahHg58Hy6DICCsso93nJ3u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d1a5cb94fca1c7849ccf76591e686a7

Files

0d1a5cb94fca1c7849ccf76591e686a7
.exe windows:5 windows x86 arch:x86

8660b15047f0a22150da6eac0443b4c5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
CopyFileA
GetStartupInfoA
GetConsoleOutputCP
GetOEMCP
GetCurrentThread
GetCurrentThreadId
SetLastError
GetCommandLineW
lstrcmpiA
lstrcmpA
MulDiv
lstrlenW
GetCurrentProcessId
SetCurrentDirectoryA
GlobalFindAtomW
GetACP
RemoveDirectoryA
GetUserDefaultLangID
GetModuleHandleA
GetTickCount
GetCurrentProcess
lstrlenA
GlobalFindAtomA
Sleep
GetWindowsDirectoryA
GetVersion
lstrcmpiW
LoadLibraryW
DeleteFileA
DeleteFileW
GetDriveTypeA
QueryPerformanceCounter
GetLastError
GetModuleHandleW
GetThreadLocale
IsDebuggerPresent
VirtualAlloc

user32

GetDesktopWindow
GetSystemMetrics
CharNextA
GetDC

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ