1182636699d8891be1e909940a2509f3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1182636699d8891be1e909940a2509f3
Size

112KB
MD5

1182636699d8891be1e909940a2509f3
SHA1

202658e8010c931b76c0a5df90b42e2dd6c40e79
SHA256

7864c30570bf7d4f29fe327b2516d7577ec55122f02ad67d47f383d9260a5276
SHA512

3d9149fe00eebbdf2f96c88cac037febbfcb9a7764cd3b0485c787d411e99bb7bd06c02caf22cbfe5892676b5be8b10d0b1cd0f39584c91cf3bfb80b0c12f23d
SSDEEP

3072:8f+/YoGGy0jvpGvQ0UvbuYUASAJvxkl84ZY:T/Yhf0joxUvbuYfSik+4ZY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1182636699d8891be1e909940a2509f3

Files

1182636699d8891be1e909940a2509f3
.exe windows:4 windows x86 arch:x86

be55fd0220ca5cb2694346eec61aa784

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

FindResourceA
LoadResource
LockResource
SizeofResource
VirtualAlloc
GetModuleHandleA
GetProcAddress
WaitForSingleObject
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
VirtualProtect
GetCurrentProcess
CreateThread
GetCommandLineA
GetStartupInfoA

msvcrt

__set_app_type
_controlfp
exit
strstr

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ