5186e7996ea4e495bd04ba0700a5bf88 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5186e7996ea4e495bd04ba0700a5bf88
Size

64KB
MD5

5186e7996ea4e495bd04ba0700a5bf88
SHA1

d4487e7ef72fc71c2e1c847b414618e9ae5b5890
SHA256

32104d444755531e5e6a1cee2ba8055678bdf68e6ba38408385cb26c6d25bbd2
SHA512

094e0c08043138babb4cfbb2c4211569bc07b74e9364e6580c8c6e687faabd99fd9b95656b770581f2fc485dd39911ba0363a46122aa48a303b01240d236b01d
SSDEEP

768:Ne/N6kUB6yi/RlgqyQfhVEBvB+VnsKIVxsYzhMXTxok:Ne/N6n6yi/Rl/5VwB+Vs9VxJhMXTx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5186e7996ea4e495bd04ba0700a5bf88

Files

5186e7996ea4e495bd04ba0700a5bf88
.exe windows:0 windows x86 arch:x86

b599fcc0bdac1f16592a3e551046a7f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
SetFilePointer
WriteFile
CreateFileA
CloseHandle
SetFileAttributesA
DeleteFileA
GetCurrentProcess
GetSystemInfo
GetLastError
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetStartupInfoA

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA

winmm

mixerOpen
mixerGetLineInfoA
mixerSetControlDetails

msvcrt

_controlfp
_except_handler3
??3@YAXPAX@Z
__CxxFrameHandler
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ