61a1e166819a34261308becd7cd63878 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

61a1e166819a34261308becd7cd63878
Size

181KB
MD5

61a1e166819a34261308becd7cd63878
SHA1

b56b338a93e3687ed33fc7059505383f785a79ec
SHA256

cab7b2ad540d95856dba297b77302dec523debbfbf4ae3fbb9a96df6ee881730
SHA512

4ec81d719fdac31f703100c49e5be89a91d7d5eb5ed49d9c7ea954a166f7e6b8fcf667be0c47c2a3d31d137dccdecf2b6c97061b21a9e12eba9e18d78a9f7155
SSDEEP

3072:FkxoEzHWWF6y3jGo9waINKLpk9kJRz/gSA+R3VGQDkHTOlCPHfcm6P2S/Uh5qkH:mXWW3jJcND9k7zmql1waEP36PWl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61a1e166819a34261308becd7cd63878

Files

61a1e166819a34261308becd7cd63878
.exe windows:5 windows x86 arch:x86

745240d06f97266c6e159934e8bbab59

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateAcceleratorA
GetCaretPos
OpenWindowStationW
MonitorFromRect
GetWindowTextLengthW
IsIconic
GetWindowPlacement

kernel32

VirtualProtect
GetStartupInfoA
SetDefaultCommConfigW
ExitProcess

shlwapi

PathIsLFNFileSpecW
SHReleaseThreadRef
PathRemoveBackslashA
StrCSpnW

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 986B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE