57bee27739495db19dcc4e4971b288cc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

57bee27739495db19dcc4e4971b288cc
Size

99KB
MD5

57bee27739495db19dcc4e4971b288cc
SHA1

8c87d666c072ec4e72b98265160660f6eff9b631
SHA256

ce782f73228c8ce9ed2c3ba8651cd3fa73fe964758f6f51352cc93521fbb20bf
SHA512

137f00bff7ae58020ca760e9fe2512217a61418819fc1b3c1867ef5710af29950240d4691cef2b7e5fb1c8b296d8cb8f3aecfdcbdd3c99e85ef7186021985fa4
SSDEEP

3072:Et4hH61EHuHchZmf7WtzUKebgOvsvZJv3A28E:Et4hHEGDmTszUK0LsvZJD/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57bee27739495db19dcc4e4971b288cc

Files

57bee27739495db19dcc4e4971b288cc
.exe windows:5 windows x86 arch:x86

4a3fe7424ee4f152e424518bec1a172c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??2@YAPAXI@Z
malloc

kernel32

VirtualAllocEx
lstrcpyA
WriteProcessMemory
ExitProcess
GetEnvironmentVariableW
CreateProcessW
GlobalAddAtomA
CreateRemoteThread
WriteFile
Sleep
CreateFileW
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetProcAddress
CloseHandle
GetModuleFileNameA
GetModuleHandleA

user32

wsprintfW

shell32

ShellExecuteA

ole32

CoCreateGuid
StringFromGUID2

ntdll

memset

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 398B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ