06b8b673d28201d72dc82ba9ec6b42d5 | Triage

Sharing

General

Target

06b8b673d28201d72dc82ba9ec6b42d5
Size

8KB
MD5

06b8b673d28201d72dc82ba9ec6b42d5
SHA1

146019310895a0a87a93382008e6336b9a885045
SHA256

77f17a60a65eddb27665d2d64b339d17b5649db2e2b17dc87a9071532b00c752
SHA512

b542fba82cfd2a9468f866a3b6ed96aa62dc7938d8bb99c87c75b1049a40a3b9b37b0020234119c2ca1e377fb266ed365cd5bef23d19e6a77c8deaac6d303ee2
SSDEEP

192:7hysd/yEeWDyGCKvQEe4i0RVZkLgBgs/v8e:B/RDyjKLBggvJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06b8b673d28201d72dc82ba9ec6b42d5

Files

06b8b673d28201d72dc82ba9ec6b42d5
.exe windows:4 windows x86 arch:x86

b8f5cf47c46467354cfcdba914516790

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
ResetEvent
GetProcAddress
lstrcatA
GetModuleFileNameW
CreateEventA
WideCharToMultiByte
GetProcessHeap
WaitForSingleObject
FreeLibrary
lstrcpyA
HeapAlloc
HeapFree
Sleep
ExitProcess
GetModuleHandleA
GetCommandLineA
SetEvent
CreateThread
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
InterlockedExchange
VirtualQuery
PulseEvent

user32

DestroyWindow
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
CreateWindowExA
IsChild
GetParent
AnyPopup
GetForegroundWindow
ShowWindow

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE