20c0807b8cd18e71448a45e3a381193b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20c0807b8cd18e71448a45e3a381193b
Size

5KB
MD5

20c0807b8cd18e71448a45e3a381193b
SHA1

1cb67d5940162f2df65f9a883e75152968fa68f1
SHA256

62531b6ef0db8378cf9339a9ce1df786903ada5a95418490de2b875d486971dd
SHA512

31b7e9b22c002eca1e8d89c00f70859970974a3a8daf9ba45d7088a13a71e2a31de9ec79533eeaf5652b9d60b99f79d38cb298aa1dc3e8af0ce29c0a74003cf9
SSDEEP

96:zj09zXr0IfAa9CPoOwovrI4AM3BsNEUe0IO9rxmi:H0NX1hioOXvrI4AGBEztIO9Nmi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c0807b8cd18e71448a45e3a381193b

Files

20c0807b8cd18e71448a45e3a381193b
.exe windows:4 windows x86 arch:x86

a531fef64303909decf120fac8e50542

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
lstrcpyA
WideCharToMultiByte
GetModuleFileNameW
CreateEventA
CreateToolhelp32Snapshot
Process32First
CompareStringA
CloseHandle
WaitForSingleObject
GetModuleHandleA
GetProcessHeap
PulseEvent
HeapAlloc
HeapFree
ExitProcess
SetEvent
CreateThread
GetProcAddress
ExitThread

user32

GetDesktopWindow
IsWindow
GetParent
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

gdi32

SelectObject

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE