638ae6b7e75b15d999c0f7b2b0dc2812 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

638ae6b7e75b15d999c0f7b2b0dc2812
Size

16KB
MD5

638ae6b7e75b15d999c0f7b2b0dc2812
SHA1

95970fd0b7a1da4c84d702f2eee3f0ca92204ad4
SHA256

a4807b74b507ddc618127d4c41a9fce7e85a5cb9bbb5cf50c508788d0e7641b2
SHA512

b86b36f5b74a88ea479d0597d951a5f9de5fa7ba2c9685a3aa0f9cddd39e3c4b173994acccdc197b7b16104430d106fee5e38f3fd00ef5d5c9516005f2f486b3
SSDEEP

384:05wTs40hg8TzSvz8cD8KAqU4lRl78MPBc8SMEKSsKDQNxWeN:eF2z8cD8T8lRlIMPBc85SsKD+9N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
638ae6b7e75b15d999c0f7b2b0dc2812

Files

638ae6b7e75b15d999c0f7b2b0dc2812
.exe windows:4 windows x86 arch:x86

61d6fdf307f435705ffecf4a9ecd4280

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

GetStartupInfoA
lstrcpyA
CloseHandle
CreateFileA
CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
LoadResource
LockResource
RtlZeroMemory
SizeofResource
WriteFile
lstrcatA

Sections

.text
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ