797ef2d97fb5f43ca4c29ad0c56dd230 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

797ef2d97fb5f43ca4c29ad0c56dd230
Size

115KB
MD5

797ef2d97fb5f43ca4c29ad0c56dd230
SHA1

75e349cd384ece60166e4235c7728f5ca6e8b44e
SHA256

4a4d13a2d08d68a56fc88c073145c839b1d0ee056ea4defb3a992e12a904d038
SHA512

44ece8cf9cb8aab299b1d0f9fcf0c2dca6563f793afb4ef726ed7a79678e1a35ce306f775b139424d4d0f0e9e6d299050c2b6cb73f5d90ab10d0cac1d789d9bc
SSDEEP

3072:NmCjjDtfMogRFluOfcqNABt2v2lrYA6hxTN4OQ4JfQt0s2:NRjtCuOQ2tH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
797ef2d97fb5f43ca4c29ad0c56dd230

Files

797ef2d97fb5f43ca4c29ad0c56dd230
.exe windows:5 windows x86 arch:x86

d88527bd0466c9b683911ac05ade11d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
lstrcmpiA
lstrlenA
VirtualFree
GlobalFindAtomA
Sleep
ExitProcess

Sections

.text
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Qgddpxoq
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Pksrokgd
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sahu, Wv
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 211B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ