4f1a87bf585d8c0357ae9553dd75a5df | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4f1a87bf585d8c0357ae9553dd75a5df
Size

878KB
MD5

4f1a87bf585d8c0357ae9553dd75a5df
SHA1

c8ec80bc3d3be5e7a4d8bd673a4ec35feca3cac9
SHA256

81898d5fe018b5e82addf62f2349e5cc3752b01ccfb30ae9ebf127c6000ee590
SHA512

847059a9e3c7001fc6ca46607635536afcb4d9e1ccb429c58741aee48e005b82ac42b849fa96b389a829ed3df32f538e9e1ff01f58170b2685c42197e5ba54ec
SSDEEP

12288:S9656vTDFXvHt/nm3iFEFAbUavmzGuBrd8itqRymwsYsp0WyQVWy8RWd:S9j/tN/leqIamzlmitqRuWAM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f1a87bf585d8c0357ae9553dd75a5df

Files

4f1a87bf585d8c0357ae9553dd75a5df
.exe windows:0 windows x86 arch:x86

77b2deee8f0c4cc27d4e9354da8a7336

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntdll

DbgPrint
DbgPrompt
NtPulseEvent
RtlUlonglongByteSwap
atan

kernel32

GetModuleHandleA
CreateFileA
GetLastError
WriteFile
ReadFile
GetVersionExA
ExitProcess
CloseHandle
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

Sections

.text
Size: 379KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trash
Size: 485KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ