64081d0fc26b8d6495dec1059d25563d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

64081d0fc26b8d6495dec1059d25563d
Size

395KB
MD5

64081d0fc26b8d6495dec1059d25563d
SHA1

891ce4596d48576638f2c8cafa306550f13b530a
SHA256

21af3f555cd6f7dbf5d38d8b073e31f10ab977ad76707a8baf470abfb2c5c795
SHA512

4c1b29ea545dfdd84368fe2d0e87440d0fb9b553d2dba101e2ab851a3d64bb383712afc8048d14a17a6bcd355b94db251f604d5af5e6c2c640d30219b40437fd
SSDEEP

12288:nxqxKMyb5GzA6BNuMGOyZi08i95oDIemBpaCYlzy0:xqxuGzA6WlzZr17Qy0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64081d0fc26b8d6495dec1059d25563d

Files

64081d0fc26b8d6495dec1059d25563d
.exe windows:4 windows x86 arch:x86

22a1e27462a81865944f004a35fcee6f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
ExitProcess
LCMapStringA
LoadLibraryA
CloseHandle
GetCurrentProcess

user32

CreateWindowExA
SetWindowLongA
wsprintfA
CloseWindow
CharLowerBuffA

advapi32

RegEnumKeyA
RegCloseKey
RegOpenKeyA
RegCreateKeyA
RegQueryValueA
RegDeleteValueA
RegSetValueA
RegEnumValueA
RegDeleteKeyA

Sections

.text
Size: 4KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ