1001224e6c11aa6ce5a5451e66473892 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1001224e6c11aa6ce5a5451e66473892
Size

16KB
MD5

1001224e6c11aa6ce5a5451e66473892
SHA1

c56c056f9ea2f9c006ffe2f4d718b89b54d3b7e0
SHA256

a191e1b269bf934700e9736298053068ad9058db8936f98ce862a35d37ebbb09
SHA512

6687c04f10d85409944176d64ae5846889e2d18a064f848a78b1abc823b0addf37dee15946ed07fa25777f01caddfdc104208e0739931e34280e96067c784a1d
SSDEEP

192:It19UB9bRBk9vllhmAVDZhB5zgAgYgnQg4gArBEaxsrQXtyI6BBHb:BO2Qmoy/r7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1001224e6c11aa6ce5a5451e66473892

Files

1001224e6c11aa6ce5a5451e66473892
.exe windows:4 windows x86 arch:x86

780aff5ba8cec24ce067340e079374a1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetSystemDirectoryA
Sleep
GetProcAddress
LoadLibraryA
CloseHandle
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
OpenProcess
WinExec
GetWindowsDirectoryA

user32

FindWindowA
GetWindowThreadProcessId

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE