f381b551129616d44d380561e6da49df[.]exe | Triage

Sharing

General

Target

f381b551129616d44d380561e6da49df.exe
Size

488KB
MD5

f381b551129616d44d380561e6da49df
SHA1

e85c8d7e358ad7ea6f7eacc1bb50e2fbb880d9c5
SHA256

6f45fa8d41e9c04c78468491d194305ce31a448ee6c732a37ebbc22210ed1536
SHA512

655062820dbe5c34d8249348f2e6ef9865225a15f910be6971d87bab0be89a49863ae9f095aa1c930295c4675b7829b678f4c99a18b12413130cd05a94d6c1fa
SSDEEP

12288:ChXG7/7qwOanLNg7JgBoyL7/wAI6BUip8iK5QjC3meLwrW6vVs5w:CxG7/7DLW7JgBomYAI2Ud5QjTe8/vVB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f381b551129616d44d380561e6da49df.exe

Files

f381b551129616d44d380561e6da49df.exe
.exe windows:4 windows x86 arch:x86

85ad3b59ceef33eb54dd6ccd9d9fa4aa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
GetCalendarInfoW
GetCurrentProcess

ntdll

RtlSetDaclSecurityDescriptor
RtlDeleteElementGenericTableAvl

user32

GetProcessWindowStation
GetInputDesktop

Sections

.text
Size: 478KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 363B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE