790e57b16e75e402b79df40cde591412 | Triage

Sharing

General

Target

790e57b16e75e402b79df40cde591412
Size

103KB
MD5

790e57b16e75e402b79df40cde591412
SHA1

12cf2cf7ff5d64d73406e706da3eebc2db97e710
SHA256

a123b6657dbccaa15275ac4f835fb0a81bbe36e1324f9552963b4eb2c2869dcb
SHA512

dfef29fbc2eed8e89d4d07151978932305541ea0cbd4515f6af4576035e71de8775c8876d090a6958318730fb4aa44046a7376435353756efdf4ff595ee210d5
SSDEEP

1536:0Y23SvShNr8c1YkmETK7oWT/elJfwyh9p5DbyWKlQ9dIwUYcWX+U:XUr7yQsoG/cfwwz5DbZIwNb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
790e57b16e75e402b79df40cde591412

Files

790e57b16e75e402b79df40cde591412
.exe windows:4 windows x86 arch:x86

1f5a69722f46c929d15a96529817bbcd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
FindAtomA
GetAtomNameA
GetModuleHandleA

cygwin1

__errno
__main
_ctype_
abort
atexit
calloc
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fflush
fprintf
fputs
free
getenv
isatty
malloc
memset
printf
putc_unlocked
puts
realloc
setlocale
strcmp
strerror
strlen
strncmp
strtoul
ttyname
vfprintf

cygintl-2

libintl_bindtextdomain
libintl_gettext
libintl_textdomain

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 656B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qjAf
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE