97c6be4335682917f0da71d68456c59c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

97c6be4335682917f0da71d68456c59c
Size

83KB
MD5

97c6be4335682917f0da71d68456c59c
SHA1

90049e02eebe014a97751de94ba24b45543c77e4
SHA256

d5b0fa40b9eb08022881ad102bf66f76bdd9c2d5252861cb36ebfb98831920b3
SHA512

249badd512ac5ef4e5126085f2c35e17c56c68ebf491adad33daf03a7c7daf12c5d639c54bc022dc55bd767adba610c0ad4db50086557b756060f3227eeff48e
SSDEEP

1536:OjXD6DgQsVGovMG2t8+wjvrr0/DdorCShgfjEErxTWDTMqhGKYIZTET8bDQ:OjXoG2tOjv8/5orHgfjBkMqhGKZTbbc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97c6be4335682917f0da71d68456c59c

Files

97c6be4335682917f0da71d68456c59c
.exe windows:4 windows x86 arch:x86

343ffd975d3c6ad68959ff7e486b2777

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCommandHistoryW
TzSpecificLocalTimeToSystemTime
RtlUnwind
GetConsoleCommandHistoryW
EnumSystemLocalesA
InterlockedExchange
CreateRemoteThread
DebugSetProcessKillOnExit
VerLanguageNameW
LZOpenFileW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE