d57b5bbdbc1b9a76e4d58c8328631061 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d57b5bbdbc1b9a76e4d58c8328631061
Size

92KB
MD5

d57b5bbdbc1b9a76e4d58c8328631061
SHA1

94e102ebb72118ccf258f61d1c9a5280b6e211fe
SHA256

cf234644f573245ffabd79fff0e4c8a2244b5c6459ff89625dea64d4597b3eb7
SHA512

2e1959a33c096d5f035024b1b0ad179bea06cbe816831f8fdafe7f5147ab6b533545f420fcf67f82959a9b47cf87c9f07b686a9141aa64c9fbd3ae9a805aa35e
SSDEEP

1536:2TFp/wA7y0meZR2l6Qox7VrdZ+spGjZY7hKppvaUxrdQ:2ZpwMy07RGox7Rdgsp4EhyFr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d57b5bbdbc1b9a76e4d58c8328631061

Files

d57b5bbdbc1b9a76e4d58c8328631061
.exe windows:4 windows x86 arch:x86

fe78727791fc90cb006340ee36fddd7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
SetLastError
GlobalCompact
FlushInstructionCache
GetProcessAffinityMask
WriteFile
GetCommConfig
ReadFileEx
GetThreadContext
FreeUserPhysicalPages
GlobalMemoryStatus
FillConsoleOutputAttribute
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

RtlZeroHeap
vsprintf
NtLockFile
strstr
NtReplaceKey

Sections

.rdata
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

WEIJUNLI
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ