b1c490b71a430f9b11e76d7b611ba0149a7ddbd61dd9a66d423a128d94b06b0d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b1c490b71a430f9b11e76d7b611ba0149a7ddbd61dd9a66d423a128d94b06b0d
Size

6KB
MD5

4d3a19b10c97f5c9ae00f0f1567b4e48
SHA1

b33c3194436c55b715abb1dc3b5df3a109ec3c78
SHA256

b1c490b71a430f9b11e76d7b611ba0149a7ddbd61dd9a66d423a128d94b06b0d
SHA512

f1d7033dc2020e9b6edd54f49f5c595cfb565b7b8088506076aa690609e39a997b5e6baeaebbcb822c829f9ad9d8a9a6a9d6f16c3e1e5feef04259395af1ceec
SSDEEP

48:S9bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uOO:Y0mIGnFc/38+N4ZHJWSY9FI5WqPx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1c490b71a430f9b11e76d7b611ba0149a7ddbd61dd9a66d423a128d94b06b0d

Files

b1c490b71a430f9b11e76d7b611ba0149a7ddbd61dd9a66d423a128d94b06b0d
.exe windows:5 windows x64 arch:x64

7c5f9b19847a4e36080308f0e2c5add5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CloseHandle
VirtualFree
GetProcessHeap
CreateFileMappingW
MapViewOfFile
OpenProcess
UnmapViewOfFile
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ