52705436ea1df5ec539b37d78bbad49a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

52705436ea1df5ec539b37d78bbad49a
Size

127KB
MD5

52705436ea1df5ec539b37d78bbad49a
SHA1

503ba7e7f58bebf223df8cb6fb12f31e9ee36167
SHA256

5a326c9d70ccd67e5dbb13eedc2e3f7a66a29d8c2fc9c4c6463fc35a48cae44e
SHA512

343b182efaf8c0053741745c2a0b302cf681ecc519e2e2caae507463e4d49739dde9d125d55b41d1fe462d8ba39d8f868ebd4125e445ad5f83b5d72debba5ce2
SSDEEP

1536:7uZl56XqDV/75uWM2fWBFcnyn6rVrf2U0TeEJvDZdKlXsu/DW9oR5fb3366h3:YqX2B0WLfy2n06rWJrSL/DWIb3qc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52705436ea1df5ec539b37d78bbad49a

Files

52705436ea1df5ec539b37d78bbad49a
.exe windows:4 windows x86 arch:x86

2521293dc396a14eb12b8266055f3900

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileExW
VDMConsoleOperation
ExpandEnvironmentStringsA
IsBadCodePtr
GetProfileStringW
FormatMessageW
DefineDosDeviceW
FlushFileBuffers
DosPathToSessionPathA
CreateHardLinkA
CreateProcessInternalWSecure

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 113KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE