589e823f9f7e8fe999c9fcbf641bc270 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

589e823f9f7e8fe999c9fcbf641bc270
Size

219KB
MD5

589e823f9f7e8fe999c9fcbf641bc270
SHA1

d88d444be6766c6971bd0a0a49d084a2d9eb133d
SHA256

1569da0d73222a1924021527f36a74b2e39e5a5d7ce63b8e0ac986a5e143381e
SHA512

294d20985ec1537304b6ff5a4fb027dc1847c0065d19a70871e95eb0f14c1bce967cbbdafe85c0d65d4b3eedbcec369ddd7e6aa722a18cbd8340d2c8cfaaa4c5
SSDEEP

3072:drzUYrOAcZhZth/WpLegkyMpAMJaJDJoTzvofswG:dMMRcHh/WptoTwJDJmcj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
589e823f9f7e8fe999c9fcbf641bc270

Files

589e823f9f7e8fe999c9fcbf641bc270
.exe windows:5 windows x86 arch:x86

e9f09953b2a1d490c32f0c2abb7a0395

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharNextA
GetDesktopWindow

kernel32

OpenProcess
SetCurrentDirectoryA
VirtualAlloc
RtlMoveMemory
GetWindowsDirectoryA
GetCurrentThread
VirtualFree

Sections

.text
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Hktshh A
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE