b52b504f675693969eb62aa61166c6cc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b52b504f675693969eb62aa61166c6cc
Size

460KB
MD5

b52b504f675693969eb62aa61166c6cc
SHA1

9de22a7b907c193bb7fe92bce4dbc2fef41d5fd7
SHA256

8eb48eb71803a977c0a339ce19093d41637f3a6bbccb44ba1115d7e1816abc01
SHA512

764b342a0316fc92f38b2f2432226b58b91797ccf8e6491f381a4e16e5eb83ef5f49de1fb9d75de41a9fae57a37cca50be566ddff4d628e4696bd549e738abc9
SSDEEP

12288:/HqVMNMRM0b4apGrVDvnFYUKn/J8Sb6e6P1gF/:B3hKvn2VNA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b52b504f675693969eb62aa61166c6cc

Files

b52b504f675693969eb62aa61166c6cc
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

a420b2162b70a585fce0d45e9a501104

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
LCMapStringA
LoadLibraryA
CloseHandle
CreateFileA
ExitProcess

user32

wsprintfA
CharLowerBuffA
SetWindowLongA
CreateWindowExA
CloseWindow

advapi32

RegDeleteValueA
RegEnumValueA
RegSetValueA
RegCloseKey
RegCreateKeyA
RegEnumKeyA
RegQueryValueA
RegOpenKeyA
RegDeleteKeyA

Sections

.text
Size: 435KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ