5be6f9657194625b857d06a5977ace23 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5be6f9657194625b857d06a5977ace23
Size

144KB
MD5

5be6f9657194625b857d06a5977ace23
SHA1

9b70f02f48dc4db2116e53b5048e227a80cdf65e
SHA256

1849b42a8677c3af5073c67fd6217506b7ae962d8e4147181b42eab23e348ac2
SHA512

8b987ac5f6a7ca60a83dc3531c856b692a2225b20015af870398ed09e7a6529cbf1096464feb9ac85c1d8c639803618fb8b2762aa704e887c9d8da6644af0baf
SSDEEP

3072:Gp6vbuEk52Cfx2PzRh1RNR1Pc2DSi5o0cVPQtrVD:c6vbtdhTN7c1iLcVYBVD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5be6f9657194625b857d06a5977ace23

Files

5be6f9657194625b857d06a5977ace23
.exe windows:4 windows x86 arch:x86

3f7ee49ebfb34638269aff44f8d2bb3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TransactNamedPipe
CreateEventA
EnumTimeFormatsA
ExitThread
TransmitCommChar
GetStartupInfoA
MoveFileExA
RegisterWaitForSingleObjectEx
GetModuleHandleA
IsDebuggerPresent
DeleteCriticalSection
TlsGetValue

user32

GetWindow
GetMessageW
GetClassWord
DdeQueryNextServer
SwitchToThisWindow
RedrawWindow
RemovePropA
RegisterClassA
DdeFreeDataHandle
SetWindowPos

msvcrt

__p__commode
_except_handler3
_XcptFilter
memcpy
_adjust_fdiv
exit
_initterm
__setusermatherr
_acmdln
_controlfp
_exit
__p__fmode
__getmainargs
__set_app_type

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ