1f1a4148a5dc92a679b8490f07199c8c | Triage

Sharing

General

Target

1f1a4148a5dc92a679b8490f07199c8c
Size

91KB
MD5

1f1a4148a5dc92a679b8490f07199c8c
SHA1

8b1548420ac4143cc34f51bb2de912b86e6680ca
SHA256

57dda12b6939cecdbe57e41413a677367b9a97d698bee4ad2cbddd5fe25a2fb3
SHA512

2ccd340fcef1b938ed9da40ee5b0b9a640c1b030825ef31203dc77a11def9f8d640ac975af72e8344be3d2b7aa59ad61c5450a0a466fc95a00f0f882b4eaf22c
SSDEEP

1536:7y8PrEpND3gp7rVCLcW08JMYXzU6k9JYLkLJlSUDIPOLIHzZR5FtvID:77gT42SQU6k9J17SExezt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f1a4148a5dc92a679b8490f07199c8c

Files

1f1a4148a5dc92a679b8490f07199c8c
.exe windows:4 windows x86 arch:x86

01ca076f9b9e51c6c714a43b90f42052

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DosPathToSessionPathW
CreateWaitableTimerA
QueryMemoryResourceNotification
GetCurrencyFormatW
GetVersion
FindFirstFileExW
lstrcpyA
GetCommandLineW
LoadLibraryA
DisconnectNamedPipe
PostQueuedCompletionStatus

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lrdata
Size: 35KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE