1bc46accb950e8e83a35191a22aa3a08 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1bc46accb950e8e83a35191a22aa3a08
Size

163KB
MD5

1bc46accb950e8e83a35191a22aa3a08
SHA1

d74c015a4fb29ec88eaeabf7ca3650c5775be885
SHA256

774f993b35f32bd7bdac63549514078cb901be70db9858997b7b3366242484a3
SHA512

9ee094ec36de3fc8b8b2e43c7487a784336eaa9448d4ef81cf4b8c0ef2fb6d5b2795d11b616754d5c9a43612a75917c742b4757dbb56261225959787d352c0c9
SSDEEP

3072:DD0WkHpbnVwsMedLD9jSCWySDlJzS5GcT8f7bIB0K/d77Y:DDpibnNf9jSlwG68TfK/B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bc46accb950e8e83a35191a22aa3a08

Files

1bc46accb950e8e83a35191a22aa3a08
.exe windows:4 windows x86 arch:x86

9a1c498e2bc5a21bcea076ebee77ebe2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetDesktopWindow
CharNextA

kernel32

SetLastError
VirtualAlloc
RtlMoveMemory
OpenProcess
GetCurrentProcess
IsDebuggerPresent
lstrlenA
GetLastError
VirtualFree
RemoveDirectoryA

Sections

.text
Size: 512B - Virtual size: 478B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Ktirk Ia
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ