95fe547bbaa4db499b9d04bf7843608b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95fe547bbaa4db499b9d04bf7843608b
Size

234KB
MD5

95fe547bbaa4db499b9d04bf7843608b
SHA1

6d468d435089495e8f6c1cb2a57179728d9d6129
SHA256

31feccf3da6fc04933d3ae09ff786132b5690c7f60cc8482f54b968b50a131e2
SHA512

bfa2f136512efa200567e83c69549f9d877bdab599cc793215d01e1d9d42b7967841ad256d4ebbe3a12838779fdbd045ed5a35df3c20e31f086172f799953cad
SSDEEP

6144:0CRnvvhIRFKDPo2pPF6xhJEC4gxfAuGdQFgEnQkkMgES:0CJpIRF0ppFG/qcFlQkkMu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95fe547bbaa4db499b9d04bf7843608b

Files

95fe547bbaa4db499b9d04bf7843608b
.exe windows:6 windows x86 arch:x86

6ef74f7b87fa15b6df54d064a5b8ef31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
GetCommandLineW
WriteFile
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
GetCurrentProcess
ExitProcess
GetExitCodeProcess
CreateProcessW
GetWindowsDirectoryW
VirtualProtect
IsWow64Process
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalFree
GetBinaryTypeW
lstrlenW
WideCharToMultiByte
EnumTimeFormatsW
GetConsoleOutputCP
WriteConsoleW

user32

LoadStringW
MessageBoxW

ole32

OleInitialize
OleUninitialize

msvcrt

towlower
malloc
memset

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 286B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ