c0bd6436b5c12530b36008e94eeddd49 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0bd6436b5c12530b36008e94eeddd49
Size

17KB
MD5

c0bd6436b5c12530b36008e94eeddd49
SHA1

1861f1451edd6f307979c3cbff943574c88f9986
SHA256

039348ce99d25fa4d95c415ca3f01013893cbfdfd4941d0a547f65ed2f097862
SHA512

ed6cef6f2978ed7b5cce0085f030ce3b97e966fe85a04363835c2012f2fc13ccccd75b1b9b1df8c3e8ad72be1b56453bd6168cd2b3fbd2a9ce438320588b8e1f
SSDEEP

384:EF1kOJEhcmZO2Zp+Nye8pqrmub8TyztsDN:E7JEhoKK8o8TyJc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0bd6436b5c12530b36008e94eeddd49

Files

c0bd6436b5c12530b36008e94eeddd49
.exe windows:4 windows x86 arch:x86

1e4c0da5737da53aff5e6e0ab7de1efa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
ExitProcess
OpenMutexA
Process32First
Process32Next
Sleep
CreateToolhelp32Snapshot
CreateMutexA
CopyFileA
OpenFile
CloseHandle
FindClose
FindFirstFileA

advapi32

RegOpenKeyExA
RegCreateKeyA
RegCloseKey
RegSetValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE