8f5aefb441edadccbb395dd5ff1ddd8a | Triage

Sharing

General

Target

8f5aefb441edadccbb395dd5ff1ddd8a
Size

463KB
MD5

8f5aefb441edadccbb395dd5ff1ddd8a
SHA1

7c2d7a310b4b2c93b13e52f6e713283aa3462df6
SHA256

190bbcc8a386cbf378ddd57f8bd5f415f14ac6ebaca00c85ae6d51c9fd4511d3
SHA512

b1f5ac8d939a8d48e832c80854367fd6cac6177afcb8eeaff810094a4f4dbfee465cee0596d284381d003d5b54fc1fb45057591b5b3301d861ce6cad8df8b908
SSDEEP

12288:B8lc87eqqV5e+wBV6O+wWoWYRJnvux0PyD+21:B8SqqHeVBxtDWYLnm31

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f5aefb441edadccbb395dd5ff1ddd8a

Files

8f5aefb441edadccbb395dd5ff1ddd8a
.exe windows:5 windows x86 arch:x86

3c6e5793e514214727b5614fbe758755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
CreateFileW
GetFileSize
ReadFile
CloseHandle
VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualFree
GetProcessHeap
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l2
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ