c6dc791470572e755a7d1fdab948e9fa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c6dc791470572e755a7d1fdab948e9fa
Size

6KB
MD5

c6dc791470572e755a7d1fdab948e9fa
SHA1

15c626661810c80ffb52aa601f98a89cff6ed554
SHA256

f6088e3541c0006c7d123ccff47e03b159fbdf7dbc1ae4b95bc715a85b666349
SHA512

ad2a8b4ae700afd23574ca663bd67764309285465710866e981ddab9008868b2b732cfcd1aa68cbbf4f639c57b90b3e5f289ed0cba589ea03d9f7d59d010858a
SSDEEP

96:Ddg3FyaPV9jndU7+vTl3v2/Mnd/KvqMpMnamWrQOl+CAa4LdWmWw:S1dr+70Tl3vEM/iaamWrx+CYWmW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6dc791470572e755a7d1fdab948e9fa

Files

c6dc791470572e755a7d1fdab948e9fa
.exe windows:4 windows x86 arch:x86

3163558c135907c1c351bec6129aad23

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwOpenFile
ZwReadFile
_vsnprintf
ZwQueryValueKey
ZwOpenKey
RtlWriteRegistryValue
ZwWriteFile
_snwprintf
RtlDeleteRegistryValue
ZwClose
RtlInitUnicodeString
_snprintf
memcpy

kernel32

ExitProcess
FindFirstFileA
DeleteFileA
FindNextFileA
GetModuleFileNameA
MoveFileExA
GetTempPathA
SleepEx
CloseHandle
GetTickCount
GetFileAttributesA
HeapAlloc
GetProcessHeap
HeapFree
BindIoCompletionCallback

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ