4ec5defae4d34c0cc5acb6b65e44e540 | Triage

Sharing

General

Target

4ec5defae4d34c0cc5acb6b65e44e540
Size

18KB
MD5

4ec5defae4d34c0cc5acb6b65e44e540
SHA1

4ab4eb8b19de312603469854529f56906560dd47
SHA256

caa094815f17cb2c6d15fe75a44f420a3a5188f4e303d8cc29ccc5360091aeb6
SHA512

cd11891ee89faca87e9fbc2e09e8f17bb8cd06c46e2a1c8cda1bcdd6729ba1b0d23b183b4db5cc91f772a3844c4d717425029a063d5918b2a8763812f83aaccb
SSDEEP

384:9XgDDy6F/syTyFzhzHlghWKbcvQ3YYxqW6Z9W1gQ4w:9Xgn/scE3IrxmZHw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ec5defae4d34c0cc5acb6b65e44e540

Files

4ec5defae4d34c0cc5acb6b65e44e540
.exe windows:5 windows x86 arch:x86

eed1ae9b5718ada1becaed20853b8cbc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtAccessCheckByTypeResultListAndAuditAlarm
RtlDowncaseUnicodeString
NtVdmControl
ZwUnlockVirtualMemory
ZwCancelDeviceWakeupRequest
NtExtendSection
NtQueryInformationThread
ZwQuerySymbolicLinkObject

kernel32

Sleep
GetCurrentThreadId
ExitProcess
GetCommandLineA
GetSystemTimeAsFileTime
lstrcpynA
GetTickCount
GetModuleHandleA
FormatMessageA
GetLastError
ResetEvent
GlobalUnlock
CopyFileExA
SetConsoleCP

msvcrt

__mb_cur_max
__setusermatherr
__set_app_type
_wsplitpath
ftell
memset
_itow
fclose

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE