65068de998ad2651f2e57a4205e25a3e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

65068de998ad2651f2e57a4205e25a3e
Size

1.0MB
MD5

65068de998ad2651f2e57a4205e25a3e
SHA1

57e7576b2d6fe75c2915f4bf8785fe4b327dfaf6
SHA256

e3f2ef3d75e32eab95cb9301437d1314c0ff18b119cd96cc4fb1dbfbaf018e44
SHA512

8d44e9f5ce4ee8c6935e974c509df31541b1d3f5921a1978565485ee5f82d86fb9d650cb36afb1a253fa7177ba1652b2b2dcaca837edcc5d5bd65416c9655bba
SSDEEP

24576:AV2Z6IBMb93sAkJp19iwUW3fGqWMOyZjoUegSJnZW4hyK:M1I+x39ePrGq7OyhoU4nZvyK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65068de998ad2651f2e57a4205e25a3e

Files

65068de998ad2651f2e57a4205e25a3e
.exe windows:1 windows x86 arch:x86

7dde3cecd2b63f1c71b7d8638d677bac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualProtect
OpenMutexA
GlobalSize
VirtualFree
FindCloseChangeNotification
UnlockFile
GetVolumeInformationA
GetEnvironmentStringsA
GetCommandLineA
GetVolumePathNamesForVolumeNameA
VirtualAllocEx
CommConfigDialogA
ExpandEnvironmentStringsA

winspool.drv

GetPrinterA

Sections

.text
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 680KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ