1a599eb0b0468c1ba4b6cf2f4f419698 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a599eb0b0468c1ba4b6cf2f4f419698
Size

4.0MB
MD5

1a599eb0b0468c1ba4b6cf2f4f419698
SHA1

9a1e040928c92f4a265f90f3386552e301103e18
SHA256

5cdbfd866dfd17f87af800cdfeef6829b51895421159178838b8302a39285821
SHA512

40dd10265eb30910ca50ea4b7f2df3bcbbeebd98479dee82035b8a40fb36c6661b9e4a89875cca72d1bcf0d605ea2c002a142b4f81ab5153904872fff2ddde5b
SSDEEP

98304:cBssk/nbPPBLTZTxpHhb1zKxsyu9d1Hv0GENCIfmGblgWDP:Ck/n7prpH+xsZ9d1HcGENCeg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a599eb0b0468c1ba4b6cf2f4f419698

Files

1a599eb0b0468c1ba4b6cf2f4f419698
.exe windows:4 windows x86 arch:x86

c13c72fa1e908e738853535529fd4b78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

CommandLineToArgvW

shlwapi

StrStrW

kernel32

lstrcmpiW
GetCommandLineW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
DeleteFileW
GetLastError
EnumResourceNamesW
LocalFree
lstrlenW
GetModuleFileNameW
RemoveDirectoryW
CreateDirectoryW
GetLongPathNameW
GetTempFileNameW
GetTempPathW
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
WriteFile
CreateFileW
LockResource
LoadResource
lstrcatW

advapi32

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE