5b0194787fa77a8891cc01950e98d834 | Triage

Sharing

General

Target

5b0194787fa77a8891cc01950e98d834
Size

268KB
MD5

5b0194787fa77a8891cc01950e98d834
SHA1

1a6ec28ed508c21db1db5618943df5880fa99715
SHA256

7ca9de4ebe734e747f107446ca23150d54bd161d2dd0a62040dd8490ba9ba7ad
SHA512

290da41b6b04700a226ca9f9714cc94c9c0e1f9eab99f8174c88dc59e120aa2d679034decab1e166e1e08a927bf679f612b3f76e98c28f4285f7d6ed3c8ba5cf
SSDEEP

3072:1yq4hbct7idvtWD3m8L/JhH0aWpcFLxZ7c8p3/n56nIGGZvr0oiMk88zXsVTvC6y:AyYvta3/jJFI8lbvr0oiNzXsc6qTcC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b0194787fa77a8891cc01950e98d834

Files

5b0194787fa77a8891cc01950e98d834
.exe windows:4 windows x86 arch:x86

3cce68a090bdf2bee3ec19f01d091f80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecW
PathFileExistsW
wnsprintfW
wnsprintfA
PathCombineW
wvnsprintfA
StrStrW
wvnsprintfW
StrCmpNIW
PathFindFileNameW
SHDeleteKeyA

user32

DispatchMessageA
LoadCursorA
SendMessageA
SetProcessWindowStation
OpenDesktopA
ExitWindowsEx
GetIconInfo
GetKeyState
CloseDesktop
CharLowerBuffA
DrawIcon
GetWindowTextA
GetClipboardData
EndDialog
GetWindowLongA
GetForegroundWindow

kernel32

VirtualProtect
CreateFileA
Sleep
MultiByteToWideChar
GetCommandLineA
WaitForSingleObject
SystemTimeToFileTime
InitializeCriticalSection
VirtualAlloc
CreateEventW
lstrcmpiA
FindClose
GetSystemTime
CreateThread
GetFileTime
lstrlenW
SetFileTime
lstrcpyA
WideCharToMultiByte

advapi32

DuplicateTokenEx
RegEnumKeyExA
CryptHashData
RegCreateKeyExA
RegQueryValueExA
CryptReleaseContext
RegDeleteValueA

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE