b876c7653dac3cc259875172c6bd18aa | Triage

Sharing

General

Target

b876c7653dac3cc259875172c6bd18aa
Size

570KB
MD5

b876c7653dac3cc259875172c6bd18aa
SHA1

6875efe08920fbc25ac453bebae212e925cfe088
SHA256

55014123e3d43c1885c4f9f0d331990946e0ebc23df4c58175ce1854fb964413
SHA512

6cb219262565d134657e6ef383235f77a89734d03c46226f12fe9a129fc8b1afb990799c9b66e652b5b5a891a6d4b75d3c4dde554a94c38b0bd57545ee40b13e
SSDEEP

12288:WQDz6DeMnsKjKVC/XvLqLrg1YxnEZEquynVJwbCHwppGeMXTn:GsJVW/+rg1fZEJMAC5Rjn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

b876c7653dac3cc259875172c6bd18aa

Files

b876c7653dac3cc259875172c6bd18aa
.exe windows:4 windows x86 arch:x86

066493f67abda220e2ab9b0e31f67912

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

_lcreat
VirtualAlloc
GetLogicalDriveStringsA
OpenMutexA
CreateNamedPipeA
GetModuleHandleA
SetHandleCount
GetFileAttributesExW
WaitNamedPipeW

tapi32

lineGetDevCapsW
lineNegotiateExtVersion
lineGetDevConfigA
phoneGetStatus
lineSetCurrentLocation
lineAccept
lineShutdown

Sections

.text
Size: 1024B - Virtual size: 925B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 209KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 113KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 206KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ