1b99cfded6dffe2eedfbfe478aa1159c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b99cfded6dffe2eedfbfe478aa1159c
Size

186KB
MD5

1b99cfded6dffe2eedfbfe478aa1159c
SHA1

16682688096ccbd72c813be4448ee4a228656cd8
SHA256

e69f568aa78a63c6c7073ee92b87c4d640d875ffe9f90cbb37cb66d4a752e33a
SHA512

92a90f7df779f634c4eef48d2520d872ed1d03d534dfea770fd7232efd335d0cc5cfc9b69591fd00682ad7bf264172531531bab506fda59a163b921d144a1b72
SSDEEP

3072:mxnbkUsyUQkfJ78CVERrBPLuFVt1J5VGfBdqg6HvyOKcQO+N0Wm8s:mmUsyUFgCOrVqF/fuqDvkcHWm8s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b99cfded6dffe2eedfbfe478aa1159c

Files

1b99cfded6dffe2eedfbfe478aa1159c
.exe windows:4 windows x86 arch:x86

c0c0d2a81d347cc51c4c4d2ed3b155db

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crtdll

memset
memcpy

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
SetThreadContext
ResumeThread
TerminateProcess
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapAlloc
HeapFree
HeapReAlloc

ntdll

ZwUnmapViewOfSection

Sections

.code
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.flat
Size: 512B - Virtual size: 41B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE