6184f2589bf6b81a389ae688d028dba8 | Triage

Sharing

General

Target

6184f2589bf6b81a389ae688d028dba8
Size

382KB
MD5

6184f2589bf6b81a389ae688d028dba8
SHA1

432080f46940a95b0224e0c9f1e645e5752d9774
SHA256

03eda151750779f6f6ff684089dc1be37e5c3541c33e170f6f781afc8f8e5744
SHA512

43fb82cbf96de16fb4e34ae1c67ecf180d921d997a5f9f05c9b7dab3bb1827fa3072b17d018f9934118162bd1e17be4aefa788c7b10b69087de03b0f09c0d689
SSDEEP

6144:uU9BhpRMi6y4+AGeJKiIdDjky49jypOAEWZqnKET5EIyLjRKg1gXVJiObl:HrpRMipAGliLy8hAEWZ+7TSHRKSgFBl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6184f2589bf6b81a389ae688d028dba8

Files

6184f2589bf6b81a389ae688d028dba8
.exe windows:4 windows x86 arch:x86

52cc4d0ee528dc54c9f3914667c03a54

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexW
SuspendThread
GetStdHandle
FreeConsole
GlobalFree
LocalSize
CloseHandle
InterlockedExchange
ResetEvent
ReleaseMutex
GetPrivateProfileIntA
WriteFile
GetEnvironmentVariableA
lstrlenA
VirtualAllocEx
GetCommandLineW
LoadLibraryW
GetSystemInfo
CreateEventW
LocalFree

advapi32

IsValidSid
RegCreateKeyExW
CreateServiceW
RegEnumKeyA
IsTextUnicode
InitializeSid
RegDeleteValueA
CloseEventLog
IsValidSecurityDescriptor
ControlService
RegQueryValueW
RegCloseKey
ClearEventLogW
InitializeSid

fwcfg

InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ