538d61dd0984b4a418d918a0793d6d18 | Triage

Sharing

General

Target

538d61dd0984b4a418d918a0793d6d18
Size

378KB
MD5

538d61dd0984b4a418d918a0793d6d18
SHA1

96b219788e444bf25bc2adb5125daccfc6d1a56e
SHA256

cf2dd93a308edd21989703a923af383cde07adac693521a38ec481fd2bad99d9
SHA512

22cfbf7fa3995f995b3c220b26685491da7e2023b371126a937240d2abea5220c515c23423d532cb567af67dd6306a68aa90cfca3dc16565646d8c7783ce810b
SSDEEP

6144:hjqBfkExquOyNb9T2duIHMjvy4NXl7F4fVv+8iRXjw3MtteuVAnR5MfQQm14jTZn:heBcExqu5T2dxiX5X8yzw3MRVARefQJU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
538d61dd0984b4a418d918a0793d6d18

Files

538d61dd0984b4a418d918a0793d6d18
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 368KB - Virtual size: 760KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ