15051[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15051.exe
Size

6KB
MD5

dc71f6d06d2e8be29e4cb42d4891e716
SHA1

771e910742696ebf309060544a95348b7d2ca452
SHA256

42d07a3be3f9de362db101744bcd9758212bfcc19bc75c70684a3fdefe5ace8d
SHA512

abcf43f3bf657483b774bd35626efc581db1efcf10cdbe43daf2508d85d29793a297bf9e733c8e35cb906781df0563fa34a62c39e3af81989f3f5ad5af993e9d
SSDEEP

96:r75ypiDzZKsupSF0l5XI6W0K2H0grvh7Afrx:xypCzIsuSO5YWUgrvd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15051.exe

Files

15051.exe
.exe windows:6 windows x64 arch:x64

8b02fffdf8776147da35bb231263383f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetStartupInfoW
VirtualProtect
HeapFree
GetCurrentProcess
ExpandEnvironmentStringsW
LoadLibraryExA
OutputDebugStringW
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcAddress
ExitProcess
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
FreeLibrary

user32

LoadIconW
TranslateMessage
DispatchMessageW
RegisterClassExW
UnregisterClassW
CreateWindowExW
SetWindowLongPtrW
DefWindowProcW
GetMessageW

ntdll

NtQueryInformationProcess
RtlGetVersion
NtQuerySystemInformation

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ