b5c0e3b6cac56617d979695217f485ec | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b5c0e3b6cac56617d979695217f485ec
Size

149KB
MD5

b5c0e3b6cac56617d979695217f485ec
SHA1

a600056d6deba56f3ce3ee774ed6badd469ad1af
SHA256

6c5991ea278e52938df841c11b15b3099084a838cb8fc34a5afc4cccf6edc9cd
SHA512

b3e7b2d86799bc1617faa1523e7549af2273fa4e5c68951785b7375f18b22cb3a3abcbb039e683ce9ff8c189c9344973760079145c4065561c08d600cec0c9e0
SSDEEP

3072:0UQlq7Mdj5q24+P6zYi8ze5AVG08j7ZPGm:0UtMdj5q24+4/xVPZPF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5c0e3b6cac56617d979695217f485ec

Files

b5c0e3b6cac56617d979695217f485ec
.exe windows:5 windows x86 arch:x86

a4c626ede29ad4a9e91bab57ac9bd215

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Trash\GuideLine.exe

Imports

user32

VkKeyScanA

kernel32

GetSystemDirectoryW
lstrlenA

Exports

Exports

?FancyBack@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?OptimusIO@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?OptionWindowGear@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?RegardSeven@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?RightApocoloptus@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?SecureCheck@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?SignSetupUp@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?SmeltIron@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?StrongFontW@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z
?TaleRevert@@YGGPAUHKEY__@@PAUHPALETTE__@@@Z

Sections

.text
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.da2
Size: 1024B - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.da3
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.da1
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ