69b3891979ccc56319b9ea1899e73ff5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

69b3891979ccc56319b9ea1899e73ff5
Size

26KB
MD5

69b3891979ccc56319b9ea1899e73ff5
SHA1

979d10d04ca3b1a08d71e74c7503d5b0137eb77e
SHA256

bdb79a433f63006d32869b9925212914c95a217251651eae264fd168e6b518c5
SHA512

faa8d0e4dbb952fa67cbad363e522b97a10878e88583b906060bc9b483617de3dc977a140edf924fccb0171bf430cbeb774d644b5a4a5ad1895ac8b5ca57fde6
SSDEEP

384:acAyz4xm++PqWiXNDgXwqWS6AZ34SEkGScDoShwaJjt3:3bQPdXNDgAqVxZ3hGSvBaJjt3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69b3891979ccc56319b9ea1899e73ff5

Files

69b3891979ccc56319b9ea1899e73ff5
.exe windows:5 windows x86 arch:x86

dd1b9f3174d0db0257fb210517510d75

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA

kernel32

GetCommandLineA
lstrcmpiA
lstrcatA
lstrcpyA
DeleteFileA
CopyFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetLastError
lstrlenA
GetShortPathNameA
MoveFileA
CreateProcessA
GetProcAddress
LoadLibraryA
GetModuleHandleA
SetErrorMode
FreeLibrary

user32

PostMessageA
FindWindowA
LoadStringA
MessageBoxA
CharNextA
wsprintfA

shell32

SHGetPathFromIDListA
ord155
SHGetSpecialFolderLocation

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE