c1d6fcc0a957dfe0ca9510f29a332d81 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c1d6fcc0a957dfe0ca9510f29a332d81
Size

19KB
MD5

c1d6fcc0a957dfe0ca9510f29a332d81
SHA1

0a400136584bb0990f96a65456f19d06ed92a25b
SHA256

3eae9a66c892e99bd8f3ca881c1db4404b2b7bbbd282e580d1d509fce70cd759
SHA512

63be37db9ffe6fe783d27b4297e20ebc1d6132491cb384be3f2e0a76dc301f9124048617fa751a574c0679f6030e26ae47f356a41d97334d8d1d5bc164152013
SSDEEP

384:V/8GUP2kwbJz9UjsP+cdl7pjK36VRHgHcCHegK2JulnfWjvOeo:OG5kssOFI6TgHcBV20ln

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1d6fcc0a957dfe0ca9510f29a332d81

Files

c1d6fcc0a957dfe0ca9510f29a332d81
.exe windows:4 windows x86 arch:x86

ea428250884fd7746a25682bffca7603

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetFileAttributesA
GetTempPathA
lstrcpyA
CloseHandle
lstrcatA
WaitForSingleObject
GetCurrentThreadId
WriteFile
SetFilePointer
CreateFileA
lstrlenA
GetModuleFileNameA
LoadLibraryA
RtlUnwind
ExitProcess
GetModuleHandleA
CreateEventA
SetEvent
CreateThread
GetVersionExA
ExitThread
GetProcAddress

user32

wsprintfA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
ShowWindow
CreateWindowExA
SetThreadDesktop
CreateDesktopA
CharToOemA
DestroyWindow
PeekMessageA

advapi32

RegCloseKey
RegCreateKeyExA

shell32

SHGetFolderPathA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ