56ea88c7325180736d925c38458549b0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56ea88c7325180736d925c38458549b0
Size

48KB
MD5

56ea88c7325180736d925c38458549b0
SHA1

a1d0df11725762415bb3ca6093ff8954142434e0
SHA256

5d7e04567243776178649a8a825717b88712f745f32d92f2d0173a5d09e9d23e
SHA512

f5e1fc9e1a78302e80d037375e7bf7cf69dcb697f7c0d18c280a4e644beddf1935591d267d635dadd1f1309620113550c5e484c4ce9ba02abc54d30a763b5710
SSDEEP

768:rAj4JQcYCL2L5FTU63uMiszHlgFRcMRsCdEO0ddUtwr46pdPicWsG7NEZnqq:rAjwQj7VuMrz4RcCdEhlRicWsKAn9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56ea88c7325180736d925c38458549b0

Files

56ea88c7325180736d925c38458549b0
.exe windows:5 windows x86 arch:x86

cfeb9badc77e174781d52f17b8e628aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

wvnsprintfW
StrCmpNIW
StrCmpNIA
StrStrW
wnsprintfW
PathMatchSpecW
SHDeleteKeyA
wvnsprintfA
PathFileExistsW
wnsprintfA
PathCombineW
PathRemoveFileSpecW
PathFindFileNameW

advapi32

DuplicateTokenEx
CryptGetHashParam
CryptReleaseContext
RegQueryValueExA
RegDeleteValueA
RegCloseKey
CryptCreateHash

Sections

.qpoz
Size: 39KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.elylit
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tovyn
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ