1c54dea50324e823e5138bb06d70d9c2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c54dea50324e823e5138bb06d70d9c2
Size

210KB
MD5

1c54dea50324e823e5138bb06d70d9c2
SHA1

1e74e5bfc3326ac0e64e18da0a1330f7a76073f3
SHA256

a217f7deed952d97fb7cee7b060e9d70dccf7339497c5499f413a25b944ff20a
SHA512

6dd59fbe9165c083ff9184239989fd8c2ba6d34b3364f198ef5b03e62b85c2f625ef62bf09d332c1ec836dbfee331efbcd6aa4ea345200b50d3b3def9d2dd8e8
SSDEEP

6144:lSppMu4CsMUWj7pfsaQIEyxIhQSYrZRJl34IH5bzd:lCpb4+R09tzhQSUD7H1h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c54dea50324e823e5138bb06d70d9c2

Files

1c54dea50324e823e5138bb06d70d9c2
.exe windows:4 windows x86 arch:x86

6927ebbd773f14d0963787436bb533ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
CreateFileA
ExitProcess
LCMapStringA
GetCurrentProcess
CloseHandle

user32

wsprintfA
CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA

advapi32

RegCloseKey
RegDeleteKeyA
RegOpenKeyA
RegSetValueA
RegCreateKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegQueryValueA

Sections

.text
Size: 160KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ