d566e53501cfdbbeefb38be372def835 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d566e53501cfdbbeefb38be372def835
Size

216KB
MD5

d566e53501cfdbbeefb38be372def835
SHA1

ec9b2e00f249fa87ce6d3e4357d0f14f8b5e8ecd
SHA256

5a7fa1a04d775e266a6d774b5bf57952fa5072de3b71dcd8edc60be862061241
SHA512

0dd8e99b4f1a7421888bed8920b20811d1d3417936eefed7d93e88dd5c9d7b162b03f5eb794468ea265d9e06098c794f2c6ff619e85aac98f530eb2e41ff9a5f
SSDEEP

6144:PpO/woia6jSzravtbzHKoqPeBsZbRy/mF19Grp4SHVzsg:PoPiaVavlz/q2uxzFMpLHN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d566e53501cfdbbeefb38be372def835

Files

d566e53501cfdbbeefb38be372def835
.exe windows:5 windows x86 arch:x86

70fdc74fdb62cba8a43d363d59635eb6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
GetCurrentProcess
CloseHandle
CreateFileA
LoadLibraryA
LCMapStringA

user32

CreateWindowExA
CharLowerBuffA
CloseWindow
wsprintfA
SetWindowLongA

advapi32

RegSetValueA
RegCreateKeyA
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegDeleteValueA
RegOpenKeyA
RegCloseKey
RegDeleteKeyA

Sections

.text
Size: 198KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ