b646d40038f927920b5b8ffa5893adb7 | Triage

Sharing

General

Target

b646d40038f927920b5b8ffa5893adb7
Size

116KB
MD5

b646d40038f927920b5b8ffa5893adb7
SHA1

aa32cc9e737f7819cc28c28d79edcc5be922c170
SHA256

496ff9ef76556f63d3181760eeb800cad1dcde3569cdf72569554fa77c1cd208
SHA512

13a387f0c29ac236e8e023a848bd57f7d750931797903b1e2a2803871a1f767d8aef5c80f1a987361e17958ca9614656e36e59a53b25347d9548038d5cceba1a
SSDEEP

3072:Mf55NOFpTyIcuz9WzF4Chdlzri6a2pyhp:Mf5XOyIcAyFD7lzDT0n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b646d40038f927920b5b8ffa5893adb7

Files

b646d40038f927920b5b8ffa5893adb7
.exe windows:6 windows x86 arch:x86

c93fd93bd6bc0a48153291ca3b76a836

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

DeviceProperties.pdb

Imports

kernel32

HeapSetInformation
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

user32

IsWindow

msvcrt

__p__fmode
_controlfp
__p__commode
?terminate@@YAXXZ
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_wtoi64
__setusermatherr
__set_app_type
_except_handler4_common

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lcjgtil
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE