c39805732db6d84abd387c3dc522fb69 | Triage

Sharing

General

Target

c39805732db6d84abd387c3dc522fb69
Size

83KB
MD5

c39805732db6d84abd387c3dc522fb69
SHA1

0face6be7f81c35c58c0e0a60441f0df310adaaf
SHA256

858604df78110174c0472b38354a2d9496ba834e94301e4d94dc369d2bc33a84
SHA512

ff53bc4974734da284652366463d7de2b3daf6680037b2b39fadbac93bb560a725a3f5e44d7b829a72a578c85998b67c128ca0b4d089538b769484e718b40732
SSDEEP

1536:+Vt83eZbW2y7REX87hwDz+z2mJQthVpqTM1jEErxTWDTMqhGKYIZTET8bDQ:+HURBwDzdITSjBkMqhGKZTbbc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c39805732db6d84abd387c3dc522fb69

Files

c39805732db6d84abd387c3dc522fb69
.exe windows:4 windows x86 arch:x86

d29985d758940df1740cc2a85c8c597c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetWaitableTimer
ExpungeConsoleCommandHistoryW
GetOverlappedResult
GetNextVDMCommand
FormatMessageA
MapViewOfFileEx
SetInformationJobObject
IsProcessInJob
IsValidLocale
AllocateUserPhysicalPages

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE