61ed2fc0c60eac81856e07055621b5aa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

61ed2fc0c60eac81856e07055621b5aa
Size

8KB
MD5

61ed2fc0c60eac81856e07055621b5aa
SHA1

f172dd91c6e866ad0dfdafd9ea8d6412cf66c42e
SHA256

c614ce8516b1b5d5d36d23e9b7104c48895d6cfd7cbb4188ebd9d19d95d74731
SHA512

2483a519dd370b0c29630b5cb24cf74528247479e16d4c73318d3ee910bafc3657b8466644a52194de38a96278e3272e69a8f43b863637dca3d81f9812fa61be
SSDEEP

96:nPxmG5KmKdvKNC1j077fZW+fCFXXFvcyIIHF:n5mG58dve1SvcyIsF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61ed2fc0c60eac81856e07055621b5aa

Files

61ed2fc0c60eac81856e07055621b5aa
.exe .vbs windows:1 windows x86 arch:x86 polyglot

2bed10be40d7d6bfd1144872c41e1720

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CreateFileA
WritePrivateProfileStringA
CloseHandle
CopyFileA
lstrcat
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetCurrentDirectoryA
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
GetWindowsDirectoryA
RegisterServiceProcess
SetCurrentDirectoryA
SetFileAttributesA
Sleep
WinExec
WriteFile

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA

wsock32

gethostbyname

user32

SystemParametersInfoA

Sections

CODE
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ