652af06296bd490fd190cad77526598b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

652af06296bd490fd190cad77526598b
Size

10.5MB
MD5

652af06296bd490fd190cad77526598b
SHA1

453c8db0442ad7e4e03f65990669532b3086bec3
SHA256

76158df9fb23700a1a1a524d83b42d60fbd0a974df1efb87ff0e61859ab7859c
SHA512

d0794bf3c8985e5a010cb1b455f44fb39f8f454cfd8001aa0e48d3c815c99d7de3e64ca9b7d30152802db8bcc921bc9d51927a15f27ab5b95dc2a2b2cbf518e5
SSDEEP

1536:O/4UqtbOi03Um0N8bbpoLelJctZltcQKp7j6AFJgyIscXf6:OQJAjkXN8bbDXctXWQKljbcyIscS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
652af06296bd490fd190cad77526598b

Files

652af06296bd490fd190cad77526598b
.exe windows:5 windows x86 arch:x86

683ea6807f54425b485625e7981107d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileA
CreateFileMappingW
LoadLibraryExW
GetFileAttributesA
GetProcAddress
LoadLibraryA
CloseHandle
MapViewOfFile
CreateFileMappingW
OpenMutexA
WriteConsoleW
InterlockedDecrement
GetTickCount
GetStartupInfoW
WaitForSingleObject
CreateNamedPipeW

onex

OneXDeInitialize
OneXInitialize
OneXAddTLV
OneXFreeMemory

Exports

Exports

gasq

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cdata
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.RSrc
Size: 10.4MB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ