56e244897854048ceac4fe33aa537da4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56e244897854048ceac4fe33aa537da4
Size

84KB
MD5

56e244897854048ceac4fe33aa537da4
SHA1

9d22b518cc40441bf4df62a90f7b6cbd26261ff9
SHA256

e6356cba40ccc8bd2ff2c5b79efd7b0df681f62f0985890a65e3ca73e940655e
SHA512

0ad0462fd85d3b73b9b48c5fcb34a3b2d5b181982e6eaa8e5a79a150ff1fc05dcbed01f1452b1faf0bfe538a829bbffd28435948442324c3a8193286c2adebfb
SSDEEP

1536:tjnYvF5k0Ts6BQHHeoxXmwZsaN18O1x9osZaCe5uxipOYdh:tjnYvLk0TsAQH+oTf8w9qCDcpOYd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56e244897854048ceac4fe33aa537da4

Files

56e244897854048ceac4fe33aa537da4
.exe windows:4 windows x86 arch:x86

7c2950680f5a3eaed3e52735182ed16b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharUpperA
wsprintfA

shell32

SHGetSpecialFolderPathA

kernel32

lstrcatA
GetTickCount
Sleep
SetCurrentDirectoryA
CreateDirectoryA
lstrcpyA
ExitProcess
GetModuleHandleA
GetCommandLineA
LoadLibraryA
FreeLibrary
GetProcAddress
lstrlenA
FreeResource
CloseHandle
WriteFile
LockResource
CreateFileA
SizeofResource
LoadResource
FindResourceA
DeleteFileA
RemoveDirectoryA
GetTempPathA
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
SetFilePointer
ReadFile
GlobalFree
GlobalAlloc
GetLocaleInfoA
GetSystemDefaultLCID
GetVolumeInformationA
GetWindowsDirectoryA
HeapFree
GetProcessHeap
HeapAlloc

advapi32

RegSetValueExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE