5b96342d140124392b379928ec08414b | Triage

Sharing

General

Target

5b96342d140124392b379928ec08414b
Size

86KB
MD5

5b96342d140124392b379928ec08414b
SHA1

d7d5e18d90604dc429a63143d037f898ad734ce5
SHA256

8875a0cab30ec17e2c1516858387fc6ec3296d91362bb1b013f69469654952ea
SHA512

18c926988bdc0154875bb6b86853a019e10e8ebe1dd34d26dfdc30a7b3f8a3df2bf5bf3d2d753d375216969e41d7af78cf36a5c058da7fda8b3511ab6b96f76c
SSDEEP

1536:8uRcJAd0WT3wXcCFspnyg4ZDt3dbe0LvEpj6LA72fTYU0t0l5snR+7WGDFBj3P7J:8ec+djwMOswXZZ3oOvMj6LA6x0t+Ss7H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b96342d140124392b379928ec08414b

Files

5b96342d140124392b379928ec08414b
.exe windows:4 windows x86 arch:x86

f1ca6e34204b4fbb0324a8a51f9850a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFileEx
FindFirstVolumeMountPointA
ReadConsoleOutputA
GetConsoleCommandHistoryLengthW
IsSystemResumeAutomatic
SetFileApisToOEM
SwitchToFiber
GlobalReAlloc
GetConsoleHardwareState
GlobalGetAtomNameW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ice
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE