649f1a366a550064b4aadb4a039b2885 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

649f1a366a550064b4aadb4a039b2885
Size

7KB
MD5

649f1a366a550064b4aadb4a039b2885
SHA1

3ea13e9ca5e089e92daf104bc3b661a547fab2e6
SHA256

4eed9c3e0c7beff6d791773b5231fdfaa04a48dabdb0d06421133326febaf35e
SHA512

e1bb06bc44ddf733b55b585573ce4ede2c75e28b5bc54d74d120199d04c372110b8e22c8cb36ad4e109ed8573f3ad2e0bd7080e0fd344bcd579b208eb967e6d3
SSDEEP

192:K+xhF/8yGPvKSGv+Sp0jLy9GBsI2+/v8i:5/8yiKy/LAI2+v9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
649f1a366a550064b4aadb4a039b2885

Files

649f1a366a550064b4aadb4a039b2885
.exe windows:4 windows x86 arch:x86

f75e6ece45bf1ec74c18d20e819b4b84

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
WideCharToMultiByte
lstrcatA
VirtualQuery
InterlockedExchange
CreateEventA
WaitForSingleObject
CloseHandle
GetModuleFileNameW
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
GetModuleHandleA
SetEvent
CreateThread
GetProcAddress
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
ResetEvent

user32

CloseWindow
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE