c649e6b04641116b13e0708e107cda1f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c649e6b04641116b13e0708e107cda1f
Size

162KB
MD5

c649e6b04641116b13e0708e107cda1f
SHA1

9d633f1bc1f98c54152663c1c187addc1f5c41b1
SHA256

e364fb3fad29dc7073f398304bca8ccdc5be19f696cead4176ea2429d3702787
SHA512

fdb88abfeebddd033c8d7ef915e0a4b1dfc5ff40194fabbbf85586c07cc922327e90d6f9b886395f305062edfd286ab8755852a8291f72944abe79eb970c29b3
SSDEEP

3072:wTY8ajOKJeJ6oR7D9lWG3S+NdrWX7e9svu7CxDaGErC2Q9H:wk8oHcxhRRCwdry7MeRxOprC3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c649e6b04641116b13e0708e107cda1f

Files

c649e6b04641116b13e0708e107cda1f
.exe windows:4 windows x86 arch:x86

ff2d6375a8ed902f2f4224434b056946

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

clusapi

CloseCluster

kernel32

ReplaceFileW
Sleep
InterlockedCompareExchange
TerminateProcess
GetProcessId
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
EnumResourceTypesA
UnhandledExceptionFilter
InterlockedExchange
SetUnhandledExceptionFilter
ExitProcess
GetTickCount
GetCurrentProcessId
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcess

user32

EnumDisplaySettingsW

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ