142de56a9277b0a6315be0c16874a03b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

142de56a9277b0a6315be0c16874a03b
Size

14KB
MD5

142de56a9277b0a6315be0c16874a03b
SHA1

6add584d011046f95fca6f41a93221ff42f80c6c
SHA256

abe0f3ec1e68c51f1fa598bf32ce2d85359a4747a4b3b75d5ad16b2ae892c245
SHA512

98c70ec4344d65d0c75af6b469cdf9e17459c63be121dc1f95ce16f8de773935915b7bb6a49440ab28e69fb88ae77d54e3004c49b4aa38e9bbe0916adb82d38b
SSDEEP

192:1apvp7DstdrCygHdAb65Oh0iB6E4LfBrkgxQawYlJay:0lpGNCxdAb6IZ4LpIgxlay

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
142de56a9277b0a6315be0c16874a03b

Files

142de56a9277b0a6315be0c16874a03b
.exe windows:4 windows x86 arch:x86

058dc95f89656af78e1cde9d00861259

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateProcessA
ExitProcess
GetEnvironmentVariableA
GetModuleFileNameA
GetShortPathNameA
GetThreadContext
ReadProcessMemory
ResumeThread
SetThreadContext
VirtualAllocEx
WriteProcessMemory
lstrcatA
lstrcpyA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE