b7e6cd427016757533e509b29fba4d0f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b7e6cd427016757533e509b29fba4d0f
Size

169KB
MD5

b7e6cd427016757533e509b29fba4d0f
SHA1

d73bf7d3709dd73063fdcd50c9a0e70b719c736f
SHA256

5132185aa960fa30985fc511a59a04227e8f9350b3800210082446b7e08d0990
SHA512

b151dffd29a7b52f68938b34d6e3c6b9b90a6d364c13d7a554f5c333b0aa67539a38da0adb5f19b6e2c602fa6110db9c200935516f9b8a1d0c5c99b5a6a64c85
SSDEEP

3072:hU6R+99AipVRB9mQrrGtVu2TXrG/gpL0e49Bp2+Q+HS7i:hlW9zbR3mOou2TbG4h4Bp2+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7e6cd427016757533e509b29fba4d0f

Files

b7e6cd427016757533e509b29fba4d0f
.exe windows:4 windows x86 arch:x86

663d4300e2ecfb1bfc52dc908f03ba86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcsncmp
strcmp
time

kernel32

GetModuleHandleA
IsBadReadPtr
GlobalAlloc
GetACP
lstrlenW
ExitProcess
GetLastError
LoadLibraryExA
GetModuleHandleW
GetProcAddress
VirtualAlloc
LoadLibraryA
GetCommandLineA
ExitThread
GetCommandLineW

advapi32

RegQueryValueExA
RegEnumValueA
RegDeleteKeyA
RegOpenKeyA

shell32

SHGetFileInfoA
DragQueryFileA
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHFileOperationA

oleaut32

SysFreeString
SysAllocStringLen
RegisterTypeLib
SafeArrayPtrOfIndex

shlwapi

SHQueryValueExA
PathGetCharTypeA
SHGetValueA
SHDeleteKeyA
SHStrDupA
PathFileExistsA

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ