be6a0b57a0d650ea58eccf39c013e612 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be6a0b57a0d650ea58eccf39c013e612
Size

148KB
MD5

be6a0b57a0d650ea58eccf39c013e612
SHA1

fcd055e5488e614fad7713fbb91ac92f024d2594
SHA256

9e9f6c0c7136741180bb2455d124a2882758a874bfc181666042108233ee753f
SHA512

a2e02cfabb6de00470ef91e5dac486a9b136c050ef81af132c11601284c9cfeaf190bad6ef43d5e6a9d16968178d6bf1192151be1b7bcedd6cf6ad5a819c4b5e
SSDEEP

3072:c679HhF+s0dDe/5zU4DhFE+AFFPT6NpBAcQir:h9n+bdCxaNl6DJH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be6a0b57a0d650ea58eccf39c013e612

Files

be6a0b57a0d650ea58eccf39c013e612
.exe windows:4 windows x86 arch:x86

197851f704483e2c9297356134da897f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
TlsGetValue
ResetEvent
GetExitCodeProcess
GetTickCount
SetLastError
CloseHandle
CreateThread
LocalFree
GetDiskFreeSpaceW
FindAtomA
CreateFileA
GetCommandLineW
SuspendThread
GetComputerNameA
HeapCreate
SetEvent
GetSystemTime
GetModuleHandleA
LoadLibraryW

advapi32

RegQueryValueA
CredFree
GetLengthSid
GetFileSecurityA
IsTokenRestricted
RegDeleteKeyA
GetUserNameW
RegCreateKeyExA
RegEnumKeyExA
CreateServiceW
CloseEventLog
RegEnumValueA
RegCloseKey

cryptui

CryptUIDlgSelectStoreA
CryptUIDlgCertMgr
WizardFree
LocalEnroll
CryptUIDlgSelectCA

powercfg.cpl

CPlApplet

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 286KB - Virtual size: 286KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ