6e097938b42df74717d494ce2059e678 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6e097938b42df74717d494ce2059e678
Size

93KB
MD5

6e097938b42df74717d494ce2059e678
SHA1

a0030e0631a40ba7e34abafee62cc5997e34fb5e
SHA256

eb0a0898054e585456e227c4371c3644de79d7373049609498e744835c7913d5
SHA512

01d43b6db2829e2b0684794f36098f23d85891902a4616612decc7e27a4cbd8d8eb61436b40b28dc2dfa1563296787290a0b6777a4a69552248d44f8bc0f5dca
SSDEEP

1536:E8g8u1tG3i2SLAwHks/4eoEAs0mvJK41UXrYkKr5Yzu0FAUK+4R+rl8/v0:T3iHN/4eas0mYAosKtFg+4QrW/v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e097938b42df74717d494ce2059e678

Files

6e097938b42df74717d494ce2059e678
.exe windows:4 windows x86 arch:x86

7da756264de652b669491034a7e6b024

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
GetVersionExA
GetCurrentDirectoryA
GetSystemDirectoryA
GetCurrentThread
GetStdHandle
GetProcAddress
LoadLibraryA
VirtualProtect
LockResource
GetCurrentProcessId
FindResourceA
LocalFree
CreateEventA
ExitProcess
CreateMutexA
VirtualAlloc
GetWindowsDirectoryA
GetCurrentProcess
LocalAlloc
LoadResource
GetCurrentThreadId

advapi32

GetUserNameA

user32

GetForegroundWindow
GetSystemMetrics
GetActiveWindow

msvcrt

memset
memcpy

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ