8c5fb7716b3b4222464133da6d2edde8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8c5fb7716b3b4222464133da6d2edde8
Size

64KB
MD5

8c5fb7716b3b4222464133da6d2edde8
SHA1

c279eef87075f4752ed16eee59dfd809fc57c92b
SHA256

e7432b253ba7c09c0897bacc3735ee89cfca22e807acc38eac7f7e106ede6b07
SHA512

e8e8ab2848646a8832fabe886d984ce67953a3e62951b5f032f69c0a9678f5e7d5b5d36ad09053e5aa43a97cadb55596cd0857e218ca796b6588f84c333ff0f6
SSDEEP

768:p8okvXTrtrjXCVvsXfZWgFLS4VdJntqevhNq4w5z4SI0373MTKg+VEbWy:pCrjnEgF262/P373Zgk9y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c5fb7716b3b4222464133da6d2edde8

Files

8c5fb7716b3b4222464133da6d2edde8
.exe windows:4 windows x86 arch:x86

32621015e66a6ab1b620d518d46f0635

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strncpy
malloc
free
modf
_CIpow
_ftol
atoi
sprintf
strncmp
_strnicmp

kernel32

GetProcessHeap
LCMapStringA
GetEnvironmentVariableA
CreateFileA
WriteFile
CloseHandle
GetModuleFileNameA
IsBadReadPtr
HeapFree
CreateProcessA
RtlMoveMemory
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
HeapAlloc
GetModuleHandleA
ExitProcess

ntdll

ZwUnmapViewOfSection

user32

MessageBoxA
wsprintfA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1002B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE