c1d3957cf59002a3139f7b3151ccc115 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c1d3957cf59002a3139f7b3151ccc115
Size

381KB
MD5

c1d3957cf59002a3139f7b3151ccc115
SHA1

5de822895cb2e9e5010cd6037f2ef9ec2275ef21
SHA256

ef4a3b191e6238e00b13bda03a76d547b4b28dfdcdd61adbd13b9e7fcd9bf10d
SHA512

1ad80c2cda655bd3761bf1f34dcb7e394db38dfe434c7bf8ab70380058b10d33d18cb0cdfd63af3af58507aa9fa3907f200c74ecdf465386a0094ed11f04f32e
SSDEEP

6144:VkgTmhVwZHcpnNEPxAbLu0TFOyfOkl4eR9gSnRuWNr792LEi+U/vqSuB+D2EfX5b:VkgChV6HcHgx4F3ngWNr7sJF/vq9fy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1d3957cf59002a3139f7b3151ccc115

Files

c1d3957cf59002a3139f7b3151ccc115
.exe windows:5 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

.Kaos2
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kaos12
Size: 377KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kylin
Size: 1024B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE