6563ef6a6514ce2d25cc7fae05f8e997 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6563ef6a6514ce2d25cc7fae05f8e997
Size

76KB
MD5

6563ef6a6514ce2d25cc7fae05f8e997
SHA1

9698bcd27084962225e01026173dddfec704cf31
SHA256

a0723da7a4e50fb556b54458247872d9813f2d287fd2749ef2891e33fc003401
SHA512

ccff5b76c69f411c5bc34ede2dec9429232c6be00eeedda1e921fc81f023ccff588e7a72bee92f21f106e042948ba2291ecfeaa2a96b018bd8424e6c6c26b1ce
SSDEEP

1536:6mmmmUgooAtZRCXUWDOTWgzoycyjmw31ROctNIqpjVrs2ryrd1vUQuq6:6mmmm5ooAtZYw/osmYRfBHs2qo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6563ef6a6514ce2d25cc7fae05f8e997

Files

6563ef6a6514ce2d25cc7fae05f8e997
.exe windows:4 windows x86 arch:x86

d1bf94025e7d074501bf397d4bc71715

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
Heap32ListFirst
CompareStringA
WTSGetActiveConsoleSessionId
GetDriveTypeA
VirtualFree
ReadConsoleA
EnumDateFormatsExW
Process32First
NlsConvertIntegerToString
UnregisterConsoleIME

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE