5028beac09a2fe788c0b2144da84f39c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5028beac09a2fe788c0b2144da84f39c
Size

5KB
MD5

5028beac09a2fe788c0b2144da84f39c
SHA1

5a39af66135a7c3e8475165f1541c8ae5a9a264e
SHA256

c9fe2b0c8a3907b2bd36dd5b39f6f450b22887858ee20b4bbc1a740d4d07d705
SHA512

13a68a293a2828dfc800321306cfde36d6eff9271c9d1aa3bd78ea757f70e7be1701c70fa50a0728e93740eaa710eb526c482ae773f210cd996a7a4f599b6b9a
SSDEEP

48:SvijzcUmHrcmma2/4v0PDYRNi4k+3mROIr8Snx9ep31hlZph1KE9ePtboyl16kL:f+Ym6nYRNiomRfzOhgPtboyn6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5028beac09a2fe788c0b2144da84f39c

Files

5028beac09a2fe788c0b2144da84f39c
.exe windows:4 windows x86 arch:x86

6cdcb4e20986e1b163774f3ebfc2b78a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
Sleep
CloseHandle
GetModuleFileNameW
lstrcpyW
lstrcmpiW
OpenProcess
TerminateProcess
CreateProcessW
GetStartupInfoW
WriteProcessMemory
ReadProcessMemory
GetCurrentProcess
VirtualProtect
GetProcAddress
GetModuleHandleW
LoadLibraryW
lstrlenW
VirtualAllocEx
GetModuleHandleA
GetStartupInfoA

user32

MessageBoxW

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

shlwapi

PathRemoveFileSpecW
PathCombineW
PathAppendW

psapi

EnumProcesses
GetModuleBaseNameW

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
memset
free
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE