539cbe400f7589c0bc99e8ee70f805de | Triage

Sharing

Copy URL Twitter E-mail

General

Target

539cbe400f7589c0bc99e8ee70f805de
Size

641KB
MD5

539cbe400f7589c0bc99e8ee70f805de
SHA1

01adf99d33285de023eb9c3cfb90b4137a9dcbbe
SHA256

56b3f088c27cbe6fc3b2b1e0c388d6bfc5a313212d62336b4a07ab595fee728e
SHA512

aa68e21d9af26c63770c3962ea8174ba1bb8c1bf4e0db1231a0a53889fb0e7920c19c9a883505e6d0868522c42a58537046fc9f6975fd67e9e99606b0ce919ab
SSDEEP

12288:2Zugmq7/Nx/wkeeJ7ZHIeznaG+/4Ro9vX+SH/I2AAFahxdVyTP:2ZugmG3rJ7RzaG68oduSf/YhiP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
539cbe400f7589c0bc99e8ee70f805de

Files

539cbe400f7589c0bc99e8ee70f805de
.exe windows:4 windows x86 arch:x86

6e1f282449492d5fc7a87e6f1c3ced5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LocalAlloc
LocalFree
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualFree
VirtualProtect
GetModuleFileNameA
VirtualAlloc

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 625KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ