5c29a7846bcd76668b2f8a10476aaf4b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5c29a7846bcd76668b2f8a10476aaf4b
Size

60KB
MD5

5c29a7846bcd76668b2f8a10476aaf4b
SHA1

25c89ecaf17bf5cbf2aa861280e7eb0cc64924eb
SHA256

e411642115ef894df715a0e231c5aa766e84df8023221b4fa5d2f572a929deb4
SHA512

d2d5f6973f1a9c5cbbd65863e5465767ca021426463f5cf701ff6e46aa94b53679df06eae926b95d491d9e8befd080a800c997660fc9d1b901ec0dc5070eb9b2
SSDEEP

768:+2yo53Iwo4gNblWHGITn+UZKfApg7LheyHd:+y7oTXA+wKfAqEyHd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c29a7846bcd76668b2f8a10476aaf4b

Files

5c29a7846bcd76668b2f8a10476aaf4b
.exe .vbs windows:4 windows x86 arch:x86 polyglot

c0da4e2cbd5e72f40ed9c672924f0ecb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GlobalFree
LockResource
GetTickCount
LoadResource
FindResourceA
GetCurrentProcess
ExitProcess
lstrcatA
lstrcpyA
CreateThread
FreeLibrary
LoadLibraryA
GlobalAlloc
GetProcAddress

user32

wsprintfA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
LoadIconA

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

msvcrt

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_strnset
_initterm
__getmainargs
_controlfp
rand
_except_handler3
fclose
??3@YAXPAX@Z
fwrite
??2@YAPAXI@Z
fseek
fopen
_exit
_XcptFilter
exit
__p___initenv

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ