1e6ce466f9906b169549ac2e62f73826 | Triage

Sharing

General

Target

1e6ce466f9906b169549ac2e62f73826
Size

39KB
MD5

1e6ce466f9906b169549ac2e62f73826
SHA1

5c87eca8a5b90c83019f227053b388cf1ff3dc90
SHA256

9f6a4ef4268519e99d23638acd3e48cb52100f7c4db879cadf9c8cfb248a1747
SHA512

5f025d7ea8dd2e80d1507e9f6caf3bae868cb273462d9a38b89229d099672201b94ed27c8c2128664fec6efb84884012af69a7eb98b67d8c7f67a86504cf6ef6
SSDEEP

768:TiG10fWAnno/miA+D5MGFo9Nih/242OAWefnbk:GS0fHo/JftvFoHihOjWeI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e6ce466f9906b169549ac2e62f73826

Files

1e6ce466f9906b169549ac2e62f73826
.exe windows:4 windows x86 arch:x86

40744c0f59d74d33fd7d62585db489ab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetCurrentProcess
WideCharToMultiByte
HeapFree
Sleep
HeapAlloc
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
CreateRemoteThread
OpenProcess
ExitProcess
MoveFileExA
GetLastError
DeleteFileA
GetFileAttributesA
GetModuleHandleA
GetSystemDirectoryA
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateProcessA
GetModuleFileNameA
GetWindowsDirectoryA
SetFilePointer
VirtualAllocEx
VirtualProtectEx
GetVersionExA
WriteProcessMemory
MultiByteToWideChar
LCMapStringA
LCMapStringW
RtlUnwind
GetStringTypeA
GetStringTypeW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ