2c0ffdfacb355a776a301674cbdeff48 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2c0ffdfacb355a776a301674cbdeff48
Size

5KB
MD5

2c0ffdfacb355a776a301674cbdeff48
SHA1

b9437334eafac01c892e476bcc5cc0d9cb20d02a
SHA256

d6fdfb1c658d3238ea6c19dc4d139d7ff4265deee3bac4d317aafd1291ed42c5
SHA512

220378fa84fdf76efa8834e3582fc9b5c4f7c6f65f7971fd16c79f4dd7c9cd60623be357da661cc086fef673c0e3d586347f433a8f15e7b445c713eaa3aef9d7
SSDEEP

96:F1MLlGMnUAOT/8tVt/8bBbsJ1l4y+lzNdRhfa1BjjjjjjePHauOI:68MnU8Xt/bfCy+jdRhfa1BjjjjjjePHH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c0ffdfacb355a776a301674cbdeff48

Files

2c0ffdfacb355a776a301674cbdeff48
.exe windows:4 windows x86 arch:x86

c061180daf34c8ee66361e11ce48eb9a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetFileSize
ReadFile
SetFilePointer
CreateFileA
TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
CreateProcessA
GetProcAddress
GetModuleHandleA
ExitProcess
GetTickCount
GetModuleFileNameA
Sleep
CreateThread
GetProcessHeap
HeapAlloc

user32

wsprintfA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ