2c20a2979b809360415d33e67d6e17de | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2c20a2979b809360415d33e67d6e17de
Size

65KB
MD5

2c20a2979b809360415d33e67d6e17de
SHA1

4be4b70a8e60cc4b92495c6a30049746b1933e6a
SHA256

a1ab2476999fb69f1e90437b61d4bbdeb4f4929ca21ac84eb31f7cf2c5e0cbea
SHA512

62060123b289ba9b1f9b2441c97ac77b849fcfe28d454565c3d851fe5219ce60e10aa766b3a8788f6409dd62f85c65d123ec494b6e935d1ae9c6f7a99a9f751e
SSDEEP

1536:+LYFp6b0Idf7jKS6z006UO15gx1EJC9eXgZ5yOFbUFY0qDDg:+eY3dx11TgzNeXYyOFbiYJDg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c20a2979b809360415d33e67d6e17de

Files

2c20a2979b809360415d33e67d6e17de
.exe windows:1 windows x86 arch:x86

c90b32935d2f9b78877f90b0487af010

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
LoadResource
LockResource
MoveFileExA
CreateFileA
RtlUnwind
SizeofResource
Sleep
WinExec
WriteFile

user32

FindWindowA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowExA
PostMessageA
PostQuitMessage
CreateWindowExA
SetWindowPos
DefWindowProcA

crtdll

__GetMainArgs
exit
raise
signal
strchr

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 88B - Virtual size: 88B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 232B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE