f6465845d6172e2afe95e9aeb5bd6347 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6465845d6172e2afe95e9aeb5bd6347
Size

147KB
MD5

f6465845d6172e2afe95e9aeb5bd6347
SHA1

ff6a3f7633e78c63a801a4e7388f75f2decd64cd
SHA256

98a736060f501aada5b5940239868e8a6b1404941d60cc8dd63cf9a676534fc2
SHA512

838e09a4163a7dcfe60636a5701c0894658a947e5945d83a86f01bb0b48cee57c5aabb96e9a49bb70af6c6a7b527fb88e6ccef9642709f87cd0b541242686f86
SSDEEP

3072:HVxMAmeBZ7J4PUNAA5a2t/VG8Ny865wc8SRH710sVL3X:1KCBV6EAA42tM8k8zoH7WW3X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6465845d6172e2afe95e9aeb5bd6347

Files

f6465845d6172e2afe95e9aeb5bd6347
.exe windows:5 windows x86 arch:x86

e617d841c96e57aa3dc790b08f73d2a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
PathStripPathW

kernel32

GetModuleHandleA
lstrcmpA
LoadLibraryExA

Exports

Exports

?ExpandEnvironmentSampleStringsA@567GPAUHINSTANCE__@@U_COMMPROP@@?F
?ExpandEnvironmentSampleStringsW@567GPAUHINSTANCE__@@U_COMMPROP@@?F
?ZeroAccesA@567GPAUHINSTANCE__@@U_COMMPROP@@?F
?ZeroAccesW@567GPAUHINSTANCE__@@U_COMMPROP@@?F

Sections

.bss
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ