5c399bd7f88969155ce979c3b5114ca2 | Triage

Sharing

General

Target

5c399bd7f88969155ce979c3b5114ca2
Size

8KB
MD5

5c399bd7f88969155ce979c3b5114ca2
SHA1

4211ded726567647eaaa04ac4ed227e12cc09751
SHA256

71f87a31a19c9ebce44ff36263fbbd7ecc5c89b88cf999121e515674769db2c4
SHA512

c40f048f61f2944a9424d1765e9fa0c4207b6f9ded803b71eebdaf5d3f7f8ff3383129136acc0f9cc65a8ed1d459d6cd6fca212bba67c874c2c9601c38a915b8
SSDEEP

48:i6dOiOHyiykbABk8TVAO4mVahogFnFIjnCklAloY8QYR2xVx/BVglFQKgSbjrc4:g3hykMBk8SrmOFIjFNRm7/kUorc4oP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c399bd7f88969155ce979c3b5114ca2

Files

5c399bd7f88969155ce979c3b5114ca2
.exe windows:4 windows x86 arch:x86

06eba18b17985b5e09930d42fab7cc64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
ExitProcess
ExitThread
GetModuleHandleA
GetSystemDirectoryA
GetWindowsDirectoryA
LoadLibraryA
OpenProcess
Sleep
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
lstrcatA

user32

GetWindowThreadProcessId
FindWindowA

urlmon

URLDownloadToFileA

shell32

ShellExecuteA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ