6d056d9a249948154f0012dbe8e130a8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6d056d9a249948154f0012dbe8e130a8
Size

42KB
MD5

6d056d9a249948154f0012dbe8e130a8
SHA1

cce6790c2fead700d3c3d7646c35c03479e6330c
SHA256

49c1db7869879b3ad210b776b76b0c9888024af82e1d878f17d6056d1d07734f
SHA512

e62266a0474bed352c8032ddd4ba7402cbd85c215cc88da59d60f138704ef033ea994925aa20aa3bd593dc6b2f526c6e6ed120ff33489a7f179e4c669ba2aafb
SSDEEP

768:CNSY3eIR3kcsbhcWEOBdk2BZg9qVlMt67S3lbyn5LZPRDsj6/vb:9aeINkcpVOnk2BvVlMw7qlbg5pRDi6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d056d9a249948154f0012dbe8e130a8

Files

6d056d9a249948154f0012dbe8e130a8
.exe windows:5 windows x86 arch:x86

640d2bdf4d2adff672e98fe192bb079b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoInitializeEx

kernel32

LoadLibraryA

Exports

Exports

��pticalDword@888GPAUHINSTANCE__@@U_COMMPROP@@`D
?OpticalMode@888GPAUHINSTANCE__@@U_COMMPROP@@`D
?OpticalReverse@888GPAUHINSTANCE__@@U_COMMPROP@@`D
?OpticalSound@888GPAUHINSTANCE__@@U_COMMPROP@@`D
?OpticalSystem@888GPAUHINSTANCE__@@U_COMMPROP@@`D

Sections

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ