558aff61af84776066c609b9caf53198 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

558aff61af84776066c609b9caf53198
Size

63KB
MD5

558aff61af84776066c609b9caf53198
SHA1

d26701a77869e60879e155278c94537a81bae363
SHA256

16b9622e96e868cceff9ddacc6bfebf2298fdce03565febd58ac3835ad1dc4da
SHA512

29f540fa28d716bf77adbce07bccf13d9b53a58444ad514b8afae1be2d9f9baef45554a8c8ccfe758d73666c11f320f6d1d9061e892a1ba5493d954660fefc98
SSDEEP

1536:K4f9h8BAjvVH9Nl9k7bF5MGnparHBlW4THNHCmRkMGyL0+Zr+:K09h8BuBI5rpABIEtimRkMGS0E+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
558aff61af84776066c609b9caf53198

Files

558aff61af84776066c609b9caf53198
.exe windows:4 windows x86 arch:x86

ce4a74d422a643785f2c2b1c5074f3c1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleKeyboardLayoutNameA
AddAtomA
WriteConsoleOutputCharacterW
FormatMessageW
VerifyVersionInfoA
CreateFileW
GetCPInfoExA
OpenProcess
GetFirmwareEnvironmentVariableA
IsSystemResumeAutomatic

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE