6f018ced8133b101ba774e97fc452c75 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6f018ced8133b101ba774e97fc452c75
Size

152KB
MD5

6f018ced8133b101ba774e97fc452c75
SHA1

019f6a54296b12ff1adc4d8d165e307d1106f234
SHA256

005387e4aad23068b5fe850bb5173d82dc2148d58fc83e20a0680c48dbfb58a1
SHA512

c4f52b030a1a863dc7b4bfddf688bfea40ff691caa43f590d70444bfef683dc1f022616d55ccaf3ed5cbae4392ed64b830d043bf60573710135f062281681d5b
SSDEEP

3072:r1joJsw/4qciRA6toY6uV4Bqh95nyMqvkiSZ:Joqf5eoY1V4cyMqsb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f018ced8133b101ba774e97fc452c75

Files

6f018ced8133b101ba774e97fc452c75
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ