20c6cd3d25e38dfefdc8721e04f4b173 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20c6cd3d25e38dfefdc8721e04f4b173
Size

67KB
MD5

20c6cd3d25e38dfefdc8721e04f4b173
SHA1

7b7b4060963b4fbb1cc3c31ddfe39e6caa2534b4
SHA256

cb663d8414b748450910c5fd4bc1aab7457377a2dad98a15322efbaa4d122fe1
SHA512

8dfbf2eba12430b57312be853a2a84c5ed19668a55793830ccd209e5162a157e1f27cf8d8bf7c8c63908ef6780e82294ebd04a9ecd78088cc01a054e17344752
SSDEEP

1536:xu2/73HK74k0W4vDLZkUHNdmM3bzBZHPI+JQcmHx:C7kW4u4d73fBSuQTx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c6cd3d25e38dfefdc8721e04f4b173

Files

20c6cd3d25e38dfefdc8721e04f4b173
.exe windows:4 windows x86 arch:x86

6fb72b6342d05f68efa6339a11d4b212

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

wininet

InternetSetOptionA

shell32

ShellExecuteA

Sections

.text
Size: 61KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE