5ec77cab9fda444e6278608a7f1c98f5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ec77cab9fda444e6278608a7f1c98f5
Size

898KB
MD5

5ec77cab9fda444e6278608a7f1c98f5
SHA1

d2485118a2d4e6a84d1a23fc951e999066de2129
SHA256

7b9bbab93cdaa23aa2e99ae9baf68c09e86b6447b495c3d035a1d8687a60990f
SHA512

6aef6ea326421c96a0945376a9e77d561849ee8b55872c64394b49bca1e4e03153df5943065b06046129c03029759642594fd4d1696a2355bc0cb672420e6401
SSDEEP

24576:2XZ7Cu6dxzyt6B5TG4iKYyPeknEjKP4IBme9:NREt6BKKRPekn7we9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ec77cab9fda444e6278608a7f1c98f5

Files

5ec77cab9fda444e6278608a7f1c98f5
.exe windows:0 windows x86 arch:x86

8ce45889aa1d333897f7f457bfb7f6b7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntdll

DbgPrint
DbgPrompt
NtPulseEvent
RtlEnlargedIntegerMultiply
RtlExitUserThread

kernel32

GetModuleHandleA
CreateFileA
GetLastError
WriteFile
ReadFile
GetVersionExA
ExitProcess
CloseHandle
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

Sections

.text
Size: 477KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trash
Size: 407KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ