4506f020b8b17aa6c06152bde40ebb08 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4506f020b8b17aa6c06152bde40ebb08
Size

381KB
MD5

4506f020b8b17aa6c06152bde40ebb08
SHA1

d6e7d0facb37b791611fd9e33ede1a088482c0fd
SHA256

40ff4ffc1c5b89f7cb73941e1d75851a4c48bfc18143ffe771c85b0e10e17f34
SHA512

43b8b472529767452dadeb37d97584adb69f692fb61f88982fbd8ca576bfc5d09063d9cbe81f9fdacba5ab8085afe0fa8535c4ca48eab9b2ca040c6f2ace302b
SSDEEP

6144:XWaPoYq6aBjNzhcamvqpPj0d2vtqXHgyl2oFu4OWw3Lp9SbfUAML+QcQrbQqXJP8:GKGnHzdyqt4duaAPoROL3L3SbKLM2D6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4506f020b8b17aa6c06152bde40ebb08

Files

4506f020b8b17aa6c06152bde40ebb08
.exe windows:5 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

.Kaos2
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kaos12
Size: 376KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kylin
Size: 1024B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Fi7ke
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE