c16e29d84f8121a29b5410611dea0b1b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c16e29d84f8121a29b5410611dea0b1b
Size

154KB
MD5

c16e29d84f8121a29b5410611dea0b1b
SHA1

b58a4bcefdde246d984c959826616d14336ae30f
SHA256

c940b3cf4a9ffa30123711ffa0f34ecfb1294ccdaa1a1f176cbf99c3a3ae960a
SHA512

6fc38d3d2d5fa0ba456988196c257b89baa22dac1945b1645d376d5ea928919326670bb863a9c8a14f57996d2a719efebdd79630d95eaf73553a00ff1e67149e
SSDEEP

3072:HO4/AqESbUqbbmxUTm880nLFZeiFcjJ77U9UJNEAiDiYqStz:u3jAmCTmagiFcjt7U2YT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c16e29d84f8121a29b5410611dea0b1b

Files

c16e29d84f8121a29b5410611dea0b1b
.exe windows:4 windows x86 arch:x86

d9111fe3e1bd3c3385a05244e860208f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shfolder

SHGetFolderPathA

Sections

pec1
Size: 43KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE