d6b52bb5026caa67985345ecebf8e353 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6b52bb5026caa67985345ecebf8e353
Size

164KB
MD5

d6b52bb5026caa67985345ecebf8e353
SHA1

9b89095d3b10338f78642ae9539d5eebca361c97
SHA256

a01fb257eab190b959ec2f49aea703b4c65b83c9418a78a036bf87ce70ca76c4
SHA512

bb6f01e0c385bf60a7ba15befbe1cda0f7c69ec843d20dcdf4416a1e54eb38c736e745dc5ea3910daf3624eadcc3077726dbd447d7fadbe38bed2c424cabd60a
SSDEEP

3072:h8DI6HpUSmwZa3epE7L780H4E4+555u7ndh/7bLLJv+:SRSSmm6b7LIYLF5ju7dhHvJG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6b52bb5026caa67985345ecebf8e353

Files

d6b52bb5026caa67985345ecebf8e353
.exe windows:4 windows x86 arch:x86

53c0ca6fb29b57a1cc1d4c657f6dd155

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
CreateFileA
ExitProcess
LoadLibraryA
GetCurrentProcess
LCMapStringA

user32

CreateWindowExA
CharLowerBuffA
wsprintfA
SetWindowLongA
CloseWindow

advapi32

RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegCreateKeyA
RegSetValueA

Sections

.text
Size: 146KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ