2cbe204fd49fdbe6208bda2163298d2d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2cbe204fd49fdbe6208bda2163298d2d
Size

8KB
MD5

2cbe204fd49fdbe6208bda2163298d2d
SHA1

d9e413251c15724c2512a2b50d54acbcfebea336
SHA256

63943fe9c15d9359b8f682eec872e6ec97ee161dc368c1abc33e832996a33daa
SHA512

4876ed122c31f282935f31940511cc8d0b278d1de03d6bc608579bbce4dd232920df9539fd411119f3289fd617ea638016e6fa7fd57a47fb9f65175b9af6caea
SSDEEP

96:uAnQOU5U7qHAA33+KQOqTJj/TFlT3eAKJCtw6:u6DUmOe3Jj/DTLJw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cbe204fd49fdbe6208bda2163298d2d

Files

2cbe204fd49fdbe6208bda2163298d2d
.exe windows:5 windows x86 arch:x86

fab6c8fd776dcd45da9318211cce617e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageA
LocalAlloc
LocalFree
CreateFileA
GetFileSize
lstrlenA
WriteFile
GetProcAddress
CloseHandle
ExitProcess
GetComputerNameA
MoveFileExA
GetCurrentProcess
Sleep
CreateEventA
TerminateProcess
GetSystemDirectoryA
lstrcatA
lstrlenW
LoadLibraryA
OpenEventA
GetModuleFileNameA
LoadLibraryExA
lstrcatW
lstrcpyA

shlwapi

StrToIntA

imagehlp

CheckSumMappedFile

ole32

CLSIDFromString
StringFromCLSID

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE