14894bf1aa1fe9c08a2fd864fc0f9a37 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14894bf1aa1fe9c08a2fd864fc0f9a37
Size

187KB
MD5

14894bf1aa1fe9c08a2fd864fc0f9a37
SHA1

eead0495e73ef58c7144f73077310f1a52588618
SHA256

5b031df6c824f007ab9dd6290411226809e8e848b052397bde5eaeecb4e47f02
SHA512

508dd771ff1e7234784cc3a154a9a6ee7a3ff48dcbddaae8bbd2da141448efe03578c53f2094458588ab3d1f16944175240907e0ab5ab408a3df4ef9931971f6
SSDEEP

3072:y47OYxwKVS2c/OMTz+5nQflikZP5SRKRr1nd97kgaHexM5/I8NMeqgHG:yihSOi+5QdFYKZ1nMtexM53G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14894bf1aa1fe9c08a2fd864fc0f9a37

Files

14894bf1aa1fe9c08a2fd864fc0f9a37
.exe windows:4 windows x86 arch:x86

6f31de0e4639e21ed918e36632eeb310

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
GetCurrentThread
lstrcatW
GetConsoleNlsMode
IsProcessorFeaturePresent
LocalUnlock
LoadModule
GetCurrentProcess
GetCommandLineA
ExitProcess
GetStartupInfoA

Sections

.text
Size: 5KB - Virtual size: 822KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 178KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE