6db589fae8fbc1a8273714cfd0e03cd8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6db589fae8fbc1a8273714cfd0e03cd8
Size

65KB
MD5

6db589fae8fbc1a8273714cfd0e03cd8
SHA1

8fcc3a2ed1e449b1e166df94e3da8f3e4b6fc88d
SHA256

79ee3a931d6d97b507ba50b6110fa9adb66d2b9df2aaf0e6bc9acbe302d4c81b
SHA512

eb5499ef5fdccd6a477fcb6754f586c39fbeae8d7c94d96e8e8198beecc03beaccea415c625031f12445fdac974aa95a703d03590dc18ab023650c8783fd4a97
SSDEEP

768:xqiUeGyINIz1RKBSPTZ4uQgEYkQrqLztY2cow4JHdSragF4oNDRwnr28Xm:xlGDNIhQBSPTzQgneLztYu/J9SXeCn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6db589fae8fbc1a8273714cfd0e03cd8

Files

6db589fae8fbc1a8273714cfd0e03cd8
.exe windows:5 windows x86 arch:x86

637ab62b0b464993925f9405af30936b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
GetLastError
LoadLibraryA
GetVersionExA
GetModuleHandleA
GetSystemInfo
ExitProcess
LocalFree
LocalAlloc
SleepEx
GetCurrentThread

user32

CreateDialogParamA
SetFocus
SetWindowTextA
RegisterWindowMessageA
GetTopWindow
GetClassInfoExA
CharUpperA
UpdateWindow
TranslateMessage
ShowWindow
SendMessageA
RegisterClassExA
PostQuitMessage
LoadIconA
LoadCursorA
GetSystemMetrics
FindWindowA
EndPaint
DefWindowProcA
BeginPaint
MessageBoxA
DispatchMessageA
GetMessageA
CreateWindowExA

ole32

CoInitialize

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 870B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ