161ea53460336894b20cb69bceeee164 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

161ea53460336894b20cb69bceeee164
Size

28KB
MD5

161ea53460336894b20cb69bceeee164
SHA1

ca0eae98b617c0b0d542d9224e61f80c9bc08a91
SHA256

f5dfb783d3cda2b8bd5a4df46618419a70c695dc8b8c330fc0d652fccc37782d
SHA512

b8fde0240e2e2df2101f6505c31fc60b04ee4bc6238ae22a2b95b38c607550190d567502ae1a99bc97385412f8323cc6e2bc52650218845f60432bc15df83dd7
SSDEEP

384:Hlh3iAZN2eKkklh1vGlaz1OftKp8EhSo8VcZ:HlBiuWdul7UmV0Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
161ea53460336894b20cb69bceeee164

Files

161ea53460336894b20cb69bceeee164
.exe windows:4 windows x86 arch:x86

98f27283f9c118845ffa6d1db16f4754

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

kernel32

AddAtomA
CloseHandle
CopyFileA
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetWindowsDirectoryA
OpenProcess
ReadProcessMemory
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
memset
signal
sprintf
strcat
strcmp
strlen

user32

FindWindowA
GetWindowThreadProcessId

wsock32

WSACleanup
WSAStartup
connect
gethostbyname
htons
recv
send
socket

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE