ab32be1a4338cf686eb2f7413f9936d5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab32be1a4338cf686eb2f7413f9936d5
Size

1.4MB
MD5

ab32be1a4338cf686eb2f7413f9936d5
SHA1

b7d596ce6005d1cd98f7236467f100c861e358e0
SHA256

ba2cecdf40e7188f948e9d5eb75bb919f5bcc9cc17e808c04e293b56cdb738f9
SHA512

a5e952732814f2a053281c4abc2e8370ec44bb96ba576beaa897ada510495617206a0bb1028301881c6e0466574cd6792189306fa8a66e9fa423a2505c099921
SSDEEP

24576:nJ79FXvc2H2hjweMcRCxQm02OWJN+Vh6K+acgWMsDE6GWj7OcHs7ENRFsc+xZkqm:JBRUU2hMYnI9ohiaBnsDEhWjTs7aRFCx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab32be1a4338cf686eb2f7413f9936d5

Files

ab32be1a4338cf686eb2f7413f9936d5
.exe .ps1 windows:6 windows x64 arch:x64 polyglot

79b3362178937bf9559741c46bb9e035

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

Sections

.MPRESS1
Size: 1.4MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ