be5b7f55812632e0551bb1016964d6d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be5b7f55812632e0551bb1016964d6d3
Size

238KB
MD5

be5b7f55812632e0551bb1016964d6d3
SHA1

a3a9d340a7850dbf602ea822d6abdea4a6ec7fc4
SHA256

4074bdf4664b17d0294dc6aac04ccf0b917ba3f89264e10792333736a9f874f0
SHA512

aba9c6f6ecac634df5dba9302a07372e16e1d941838275b3aec60c2c8f6b7823f5aa9bf0a4406123cb4beae3faf5c36e188c72822d51fc0a6d772e6950ed1038
SSDEEP

6144:o6FBWZNr1uaOW8Q9GFr0KnDk9FA+kOaB4YXd1VL:roNJvGWKnD92alXbVL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be5b7f55812632e0551bb1016964d6d3

Files

be5b7f55812632e0551bb1016964d6d3
.exe windows:4 windows x86 arch:x86

498f1c3b1cfdd1f6431d4d43ce7429d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
PeekMessageA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

Sections

.text
Size: 20KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE