2504751925bcbaf494757472cf676f05 | Triage

Sharing

General

Target

2504751925bcbaf494757472cf676f05
Size

241KB
MD5

2504751925bcbaf494757472cf676f05
SHA1

fc6e0d4d8172f200e3017c72b4d367cd778ec596
SHA256

f0258bedd0691e69685da46429a0da67b8bf342a66d35ba81520225bf07a9c6d
SHA512

5efb159d57b9a37910b67db0a9edf63af6d510c6046d6cb689272d72c1474a7e8abfb0b666cce24e2326d0df0e7ac1fe3fdb62fa1ec210d9807bc6a4ea6e7f45
SSDEEP

6144:Wzb3EQcGM4Iib3XFaZqivLK/PsxBFX7BRohAWsqd7euJ3:WzbUJGMbaatvLCU3FX9JISC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2504751925bcbaf494757472cf676f05

Files

2504751925bcbaf494757472cf676f05
.exe windows:4 windows x86 arch:x86

ee0c28d19def9ef5dd3cddb373c0f083

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

cfgmgr32

CMP_Init_Detection

shlwapi

PathFileExistsW
PathRemoveFileSpecA
PathAddBackslashW
PathFileExistsA
PathRemoveFileSpecW
PathIsDirectoryW

user32

SendMessageA
EnumDesktopWindows
PeekMessageA
GetDesktopWindow
PostMessageA
EnableWindow
FindWindowW

kernel32

GetProcessHeap
GetTempPathW
GetFileSize
GetPriorityClass
ExitProcess
GetCommandLineA
GetModuleHandleA
ResetEvent
SetEvent
SetCurrentDirectoryA

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.strings
Size: 5KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ