05cf8bedc593b0136ea930fa4f968d7f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

05cf8bedc593b0136ea930fa4f968d7f
Size

484KB
MD5

05cf8bedc593b0136ea930fa4f968d7f
SHA1

29bf47f0cce27c693e7d66fa71aea845e8234caa
SHA256

ebe02055faa65ac412173689fb4810843530b445a471a7aafd41980ebef5912b
SHA512

0cded04f632f4894c6f4be18fc76440db5c0b1b2af2f37b8208095f8124198e4e264d152b0712721aea04be9483a3fb74136fc80be4f3f0a6d240a9f91661868
SSDEEP

12288:Pe/NpswbCdEdrozekB5LRxJjiZZPxuNMJWrs:PuPsDE17kPDJ+3xuNMJW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05cf8bedc593b0136ea930fa4f968d7f

Files

05cf8bedc593b0136ea930fa4f968d7f
.exe windows:4 windows x86 arch:x86

e6561374f5c9c7cde8cfbfc140908a7f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VarBoolFromI1

ntdll

RtlCheckRegistryKey

user32

GetMessageExtraInfo
GetActiveWindow

kernel32

GetCurrentProcessId

Sections

.text
Size: 478KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 181B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE