bd13fa2947b4a164ca1f040868507ae1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bd13fa2947b4a164ca1f040868507ae1
Size

147KB
MD5

bd13fa2947b4a164ca1f040868507ae1
SHA1

cbcd160cd745aa82342beec39c06905a560aca14
SHA256

8187895591943c9d6f70dc3eb30a48fd068f9bf79a971dc2bbd91b3e17f7d312
SHA512

23c9804aa31e68bd591c07c113dcd1059fa40c788824745986af70c4ce81374c48a4f2683dba353374ca2d5453758eb7afbb4ea8dc169b59bdcbd48dac47fb38
SSDEEP

3072:K6JhHOVqE8dRelURl+ES2UFl/8e2ZhOW17bI3mHMbQ3:7JMqE2BlXK7/zuph4Cj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd13fa2947b4a164ca1f040868507ae1

Files

bd13fa2947b4a164ca1f040868507ae1
.exe windows:4 windows x86 arch:x86

b2cce3b4f0176e9b0a3d60adc50807ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
CreateMutexA
GetComputerNameA
SetEvent
GetCurrentThreadId
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
SetFilePointer
GetCurrentProcess
GetCurrentThread
ExitProcess
VirtualAlloc
GetCurrentDirectoryA
ReadFile
LocalAlloc
GetVersionExA
GetFileSize
VirtualProtect
CreateEventA

advapi32

GetUserNameA

user32

GetForegroundWindow

msvcrt

memset
wcslen
wcsncpy
memcpy

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ