1fbd6e8b7aa32f0425951640f69d97e8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1fbd6e8b7aa32f0425951640f69d97e8
Size

5KB
MD5

1fbd6e8b7aa32f0425951640f69d97e8
SHA1

0a06d7ed156e367fe288898f9614a60ac7950913
SHA256

16647474bfc0051fdda9ec9846dc106da973f265887e7412726e4551deff76b9
SHA512

3c7495a7c6b8ca99517874c5c9434c7958e1f335290ebea32a61215d3ce79958e1df667a07d221f48f8f3005abc8125289b483b2cdd25eff858a30c4a7c8b46d
SSDEEP

48:SucKCWDy8l1WzlUrDBd+Gpn7UrnvfuCa:TcK3Dy8DI2DeG1EnX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fbd6e8b7aa32f0425951640f69d97e8

Files

1fbd6e8b7aa32f0425951640f69d97e8
.dll windows:4 windows x86 arch:x86

d1f3a011ab206cc9a58701161e9fb538

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WinExec
CloseHandle
_lwrite
CreateFileA
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GlobalAlloc
HeapAlloc
GetProcessHeap

Exports

Exports

FwDisable

Sections

.text
Size: 512B - Virtual size: 346B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 358B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ