53e41dd63d8658db84ca1986e0e947f5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

53e41dd63d8658db84ca1986e0e947f5
Size

5KB
MD5

53e41dd63d8658db84ca1986e0e947f5
SHA1

72e5bf527df8dc3846d91a65ba9ace7855f0c35f
SHA256

e163321c384c84d02c412b413b3b769feb7c0934e2f353eee28f8b2707cdc6d3
SHA512

fb27a1efbee489b967a711bd8402d0394c927e585c1446b05514c9deb224bdfea92d7a66234ece6c84e8719852a5e86f1c9e33d8148933e334a4caf1d60744a9
SSDEEP

48:OEPdlu5DblZvVagEPA6muBcBcJva4qBqW8w0Dhw2hXA:nPvu5Dh536Vm6fqjh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53e41dd63d8658db84ca1986e0e947f5

Files

53e41dd63d8658db84ca1986e0e947f5
.exe windows:1 windows x86 arch:x86

2a6647f9945b0bf188d414ef6348fca4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

MessageBoxA

kernel32

ExitProcess
SuspendThread
GetModuleFileNameA
ReadProcessMemory
ResumeThread
GetCommandLineA
VirtualProtectEx
WriteProcessMemory
CreateProcessA
CloseHandle

Sections

CODE
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.RPPDATA
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE