6ad71da18983bec456c8164bed6eb858 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6ad71da18983bec456c8164bed6eb858
Size

40KB
MD5

6ad71da18983bec456c8164bed6eb858
SHA1

057cd4f14b9ec15e4a63232e32477d7976841915
SHA256

41d7a6f0ee751411a50e32d86709c751ffe1e1825f373b9ba4a318955867ee50
SHA512

ac927d3eb2110f1c8205c1526be7c0b14ea0d9e507f2b70b8176478107b61732d89225e168242309b49b1a0e1aaaa78475337ea09fc9d225dc156ebb84ed46ef
SSDEEP

768:8org+DLr96gLZmjzYnP7RhRvxKq2Y1rqI:Zz4iKEFXvxKqHs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ad71da18983bec456c8164bed6eb858

Files

6ad71da18983bec456c8164bed6eb858
.exe windows:4 windows x86 arch:x86

da7da71ff376d13d331b9f2499520314

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderPathA
ShellExecuteA

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__getmainargs
__set_app_type
_access
_controlfp
_acmdln
exit
_XcptFilter
_exit
sprintf
strchr
strcat
fopen
fprintf
fclose
strrchr
strcpy
__p__fmode
_except_handler3

kernel32

GetModuleHandleA
GetStartupInfoA
WinExec
CreateFileA
CloseHandle
GetFileTime
SetFileTime
GetWindowsDirectoryA
DeleteFileA
FindFirstFileA
CopyFileA
FindNextFileA
FindClose
GetModuleFileNameA
Sleep

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

smrbpux
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE