1fe80ae6becd65b439c369b81836ff95 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1fe80ae6becd65b439c369b81836ff95
Size

52KB
MD5

1fe80ae6becd65b439c369b81836ff95
SHA1

a7284fd5c850c0cc34181b515bce16fe48dcfab1
SHA256

8bff2a6d753c62b17f6ff73ffb216c2722c369ccab460ecc5c4e22fbf0ff3baa
SHA512

cee9a97d7c51102269ba5a8e18d9d95b00844561dab6ba759438f5127d9f9f46681e804b743373d65c7e355f4ea522cef772947427982d005f865e19a27d3375
SSDEEP

1536:oOFpPDRwwmQ5BkWEfCe6GJ+IBrg3c7RJacs:oOFpPb3UjPgN3cyZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fe80ae6becd65b439c369b81836ff95

Files

1fe80ae6becd65b439c369b81836ff95
.exe windows:4 windows x86 arch:x86

3f37d431c8505d7447e97e8ea878c752

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
lstrcpyA
ExitProcess
GetModuleHandleA
GetCommandLineA
LoadLibraryA
FreeLibrary
GetProcAddress
lstrlenA
GlobalFree
GlobalAlloc
FreeResource
CloseHandle
WriteFile
LockResource
CreateFileA
SizeofResource
LoadResource
FindResourceA
DeleteFileA
RemoveDirectoryA
SetCurrentDirectoryA
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
SetFilePointer
ReadFile
GetLocaleInfoA
GetSystemDefaultLCID
GetVolumeInformationA
GetWindowsDirectoryA
Sleep
GetTickCount
lstrcatA
GetTempPathA
HeapFree
GetProcessHeap
HeapAlloc

user32

CharUpperA
wsprintfA

advapi32

RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ