61c56c24c03afe350bbf2a67923581c2 | Triage

Sharing

General

Target

61c56c24c03afe350bbf2a67923581c2
Size

43KB
MD5

61c56c24c03afe350bbf2a67923581c2
SHA1

e0c6133ad083be19bf1a0e3c92f5943b4dad7f41
SHA256

5b691fe840aa06113634b9f9b81adc75246d4dfabde3b9616686aec2d92d626a
SHA512

956f5fd4cad4d56da6371943b28befeda0313144a2e2e80ff3343e756aa1c67d161a9ebd00dee365d9b49ec0d99a5c49c7cdb7517957451110da867ef561a58f
SSDEEP

768:2X4tKVaj0qiSpI55cAR7X5S8AMuSzUiQxR39BDv3xsvG0ez:Sq7IqiSECA9Y8Aa4iQx1DZsvG5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61c56c24c03afe350bbf2a67923581c2

Files

61c56c24c03afe350bbf2a67923581c2
.exe windows:5 windows x86 arch:x86

6a94c625e08ec1199aca75e12dfcceeb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
HeapAlloc
GetProcessHeap
GetModuleFileNameW
GetProcAddress
GetModuleHandleA
RtlZeroMemory
GetModuleHandleW
GetStartupInfoW

user32

EndPaint
UpdateWindow
DestroyWindow
TranslateAcceleratorW
GetMessageW
PostQuitMessage
LoadCursorW
DefWindowProcW
TranslateMessage
LoadAcceleratorsW
RegisterClassExW
MessageBoxA
LoadStringW
ShowWindow
GetActiveWindow
CreateWindowExW
DispatchMessageW
BeginPaint

msvcrt

_exit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter

ntdll

memset
memcpy

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ