5601ce477c54b335bbab8456e9ec429a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5601ce477c54b335bbab8456e9ec429a
Size

17KB
MD5

5601ce477c54b335bbab8456e9ec429a
SHA1

b01c82d1f46528b95ec1ae814fea41e2cfe02ca3
SHA256

bd175b9f7cf0cadf231b86c29cfe4c92305cdbab7b80dee0a3eda368fdddfdae
SHA512

633eddd6126f62b4b75aeb6f96247e565c0fd070a1bf7903408e4e106a7da8ca67f656d40ea1d2e0a32dc4053e92a4f22b58c28d69d9860f45a15457702175f7
SSDEEP

384:S9iNpduhxC809A86UXlsmpVTve4/cEn7cMbIaME73d:SAAhw80C8B1smnTvoO7hbOyd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5601ce477c54b335bbab8456e9ec429a

Files

5601ce477c54b335bbab8456e9ec429a
.exe windows:1 windows x86 arch:x86

598a9f449f493abc9b35793763fb5cb5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA

advapi32

RegSetValueExA

user32

PeekMessageA

ws2_32

socket

Sections

pec1
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pec2
Size: 5KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE