cd2ed3d564f3941075487892769efd68 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cd2ed3d564f3941075487892769efd68
Size

664KB
MD5

cd2ed3d564f3941075487892769efd68
SHA1

15a3433856a37ea2023c2bbcbd1f2d9e00e11990
SHA256

5cb7a1f3aa7af703f88b744e3cb4d84d077449d03319d908ce5f1074b50fedf9
SHA512

14d40e159a093711c9f79fb102b07988b38638fede083e5f49862ae4017868a8afe86e2142826c67f0090710fea832c05c174d6b574746d291d9c54e02d8b9c9
SSDEEP

12288:n2uy0cPDEVOCAaYXuL/j0dgwMUbnOb75M0jMXKKhvwre7ECMh/JBsZ2gJGoFco:n2uyXmVABXuDuMUbnObxM/hvk6mhRBsr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd2ed3d564f3941075487892769efd68

Files

cd2ed3d564f3941075487892769efd68
.exe windows:4 windows x86 arch:x86

f1f4aac70b9aaaf29f1c51ecd11a3a52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mini_installer_full.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

kernel32

lstrlenW
lstrcmpiW
GetCommandLineW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
DeleteFileW
GetLastError
EnumResourceNamesW
LocalFree
lstrcatW
GetModuleFileNameW
RemoveDirectoryW
CreateDirectoryW
GetLongPathNameW
GetTempFileNameW
GetTempPathW
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
WriteFile
CreateFileW
LockResource
LoadResource

shell32

CommandLineToArgvW

shlwapi

StrStrW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24.5MB - Virtual size: 24.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ