5a000864ab41a9c6a448983111de8c5c | Triage

Sharing

General

Target

5a000864ab41a9c6a448983111de8c5c
Size

626KB
MD5

5a000864ab41a9c6a448983111de8c5c
SHA1

3f075a6010e83963cc694283dbc6947b66f3da66
SHA256

14e4ad38d1ca2a0439c5c869485eb49311f02a05fb50152194187f88e7f21cbd
SHA512

c4ab468c19749f0f46ed634e5700f8514ce869e559281b78e5a44552acd8ef47ca22aca361eee9fbd0a567257cc457a9da9f729008a0a8926d7668470cc69204
SSDEEP

12288:Q5hAPjSA6vYkziP27JfR4VoH4c7R5UnvRXuUZ+WU+7GQ:Qg+Lw6JWeH4KR5QyDE1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a000864ab41a9c6a448983111de8c5c

Files

5a000864ab41a9c6a448983111de8c5c
.exe windows:5 windows x86 arch:x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 443KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE