c5f9a16c786957f7fb86e0fc2fe5d71c4f82b4f483cfa6a14730dbb2495b135a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c5f9a16c786957f7fb86e0fc2fe5d71c4f82b4f483cfa6a14730dbb2495b135a
Size

6KB
MD5

74f102c0538d729f263630639fbb505c
SHA1

e8982b3a03100b5f52f2ca25db26f614b806dd9e
SHA256

c5f9a16c786957f7fb86e0fc2fe5d71c4f82b4f483cfa6a14730dbb2495b135a
SHA512

a5ee65585c96c3a963f1f7200ffbfa32a6755f1f8f5d4d7e7cf8be0bcedf9f4c3072cfc67445020c86e5188dfa1aa2499f32b309c72c96d5b04c6d8ef5ba8c23
SSDEEP

48:Shbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uDO:M0mIGnFc/38+N4ZHJWSY9FI5Wq8x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5f9a16c786957f7fb86e0fc2fe5d71c4f82b4f483cfa6a14730dbb2495b135a

Files

c5f9a16c786957f7fb86e0fc2fe5d71c4f82b4f483cfa6a14730dbb2495b135a
.exe windows:5 windows x64 arch:x64

7c5f9b19847a4e36080308f0e2c5add5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CloseHandle
VirtualFree
GetProcessHeap
CreateFileMappingW
MapViewOfFile
OpenProcess
UnmapViewOfFile
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ