5f4be5cdf986f7164e129e9969ded010 | Triage

Sharing

General

Target

5f4be5cdf986f7164e129e9969ded010
Size

171KB
MD5

5f4be5cdf986f7164e129e9969ded010
SHA1

bdc9bbfbb4418bdd0d384e731d2ec63fcc59ffa9
SHA256

7de3842235d0b7bf8bdb816b489adb512f4dc4d2306f37d0c4ecf57ae432794c
SHA512

fcac8b62d6c3665aa918c55f00adf3f188efb1c37626bd839d7b52473d4f4ecf5ce78d893724834b4b7921329ef3ebbfc09c509ae9122a92c390907b571247b4
SSDEEP

3072:6ii5SNA1YqWeIlEWV18JXkHRcQcgqTcLQmM17c+xeZcMzzpU25RqoMfnCj:7DeIl1WJXkHRnUTb5c+AXN5ay

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f4be5cdf986f7164e129e9969ded010

Files

5f4be5cdf986f7164e129e9969ded010
.exe windows:4 windows x86 arch:x86

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ