015633f4006048e40b6d6f3c0e0f0f56 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

015633f4006048e40b6d6f3c0e0f0f56
Size

33KB
MD5

015633f4006048e40b6d6f3c0e0f0f56
SHA1

57acfde5488d2b105686d209882bbb5ed2b6ab7e
SHA256

e6b14b8582196464316bb68d1af211d1c75bb25e9b851f8f6b771221a3d9eef0
SHA512

f1dc8a7abafe5fa6b208ff7f1befc23344576d8442d91f3457282155e271074837497b4e987fc34d4638ea9a4f11431bc36bfe7e1310c6065fa232ff133294b0
SSDEEP

384:D98wWOyO0/OdSRST5PWWtxLbWQskR4oKPQs:fWOyWdyqdh4D5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
015633f4006048e40b6d6f3c0e0f0f56

Files

015633f4006048e40b6d6f3c0e0f0f56
.exe windows:4 windows x86 arch:x86

46084168b412e051097ae39c055c9320

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
ExitProcess
FormatMessageA
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 4KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ