20a5f551796198cf2568f951bd6a84f8 | Triage

Sharing

General

Target

20a5f551796198cf2568f951bd6a84f8
Size

488KB
MD5

20a5f551796198cf2568f951bd6a84f8
SHA1

04603fc88cf71a7aa091ff03ecb889db58f3d659
SHA256

f331eee7b4ddb6adfefc894b6124376e0106a5034ef17cecc6c6cb1215816804
SHA512

4c684022fd6a22a36a8f8c1e89a06e1ad9a450ddfa69b6bcf5c4dcf0b47a6cb65f3ae0370f6b8312d8ccc309b9428d2b87656b75ad6aa839dad19502f99fe8a5
SSDEEP

12288:C7a0a0XPuR+O5QP8tf3FU2nzujQWK5FxxyPy:l0aHkO52aFU/Q75FxxyPy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20a5f551796198cf2568f951bd6a84f8

Files

20a5f551796198cf2568f951bd6a84f8
.exe windows:4 windows x86 arch:x86

fbbc459034f065033b659657c137264d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlIpv6AddressToStringExW

kernel32

FindVolumeClose
GetCurrentProcessId
_hwrite

user32

GetMessageExtraInfo
GetShellWindow
BeginPaint

Sections

.text
Size: 479KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 245B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE