36deca0211359f43c772999fae48b579 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36deca0211359f43c772999fae48b579
Size

156KB
MD5

36deca0211359f43c772999fae48b579
SHA1

1a6630005942f73252ef84be7dd23084f429c3a3
SHA256

46407f95f30a4662afc810999717e946e66e5585a26e9bc91d3039449e7f1926
SHA512

8ab85194e67b7264f49ebf13009f6925089f217d5cb9ed7f066c2a85773a818d9a1961690af772c1463f92d69f84ae17531e5084067977df8bda07e8c693e1ab
SSDEEP

3072:N5DrIbYZI/qiwcg0uL7lc6H1ufm/iXyc6HcT66vlmiyOInL4CInuIlzM72ccc3kk:XobYZsPwr0y7lc6HUfokyc6HcT66vlmB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36deca0211359f43c772999fae48b579

Files

36deca0211359f43c772999fae48b579
.exe windows:4 windows x86 arch:x86

b5dbb2ef53ed46d7065f93de4331a130

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetLastError
InterlockedIncrement
ReleaseMutex
CreateMutexA
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
WaitForSingleObject

msvcrt

_write
_fileno
_fstat
_isatty
_lseek
_open
_read
_close
_assert
_cexit
_errno
_fileno
_fmode
_fpreset
_HUGE
_iob
_setmode
__getmainargs
abort
atexit
fclose
fflush
fprintf
fread
free
fseek
fwrite
getc
isspace
isupper
__p__environ
malloc
memchr
memcpy
memmove
signal
strcmp
strtol
strtoul
__set_app_type

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stab
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stabstr
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ