7064af27bf3f8b158168ee9e8357771c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7064af27bf3f8b158168ee9e8357771c
Size

20KB
MD5

7064af27bf3f8b158168ee9e8357771c
SHA1

dce487866c733a31b7c7d2666b1978ba67493d27
SHA256

e2d8d868ab3bac60bb7b684fcb01430d231c26ad147e1affcef798770cb76a57
SHA512

7ce2d36036f678f1ffac60b41e1880903f3e9e3e83a6375dce2931c9b2e372639cf9628d52be4dbf9df11a144e9082c9dd6620c50b95d9fe4102378886898585
SSDEEP

192:rUf9PiCLRq1XGyQXEQj9Tv5hy+jGSMTvZ/BvPfOd+qZ2BXlZlsfcCp:rUXg14XTj9Tvf6TvZF6+E2MfJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7064af27bf3f8b158168ee9e8357771c

Files

7064af27bf3f8b158168ee9e8357771c
.exe windows:4 windows x86 arch:x86

e9093de94bb91bd8d61665e6429b741a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentStrings
WideCharToMultiByte
GetCPInfo
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCurrentDirectoryA
GetEnvironmentStringsW
HeapCreate
VirtualFree
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapFree
RtlUnwind
WriteFile
GetProcAddress
HeapAlloc
VirtualAlloc
LoadLibraryA

user32

MessageBoxA

advapi32

RegCreateKeyA
RegSetValueExA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 823B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE