dd310c04daa93db00512b5c1d1551932 | Triage

Sharing

General

Target

dd310c04daa93db00512b5c1d1551932
Size

306KB
MD5

dd310c04daa93db00512b5c1d1551932
SHA1

874a21d4947902982c4b59ae46b07aa68129aa45
SHA256

c4900ffb5afaa383f63ee8961f1a57a6d3446925ae10f90e86443927bd7f62cb
SHA512

f210b37cdad61e6123c0b3871060e12772677bc6180dc467447bc302a103f021ee38cfacd294bc05bab56b2506f6395f9fef51685f76901f6c536fd2e7d1072b
SSDEEP

6144:rdEWfy9tAeBEx/PWegqdQKd7CLZVqJ3v7SwIaFSQpvpGU:rdEVDFBEx/u5qi87I0+ucS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

dd310c04daa93db00512b5c1d1551932

Files

dd310c04daa93db00512b5c1d1551932
.exe windows:4 windows x86 arch:x86

325df2a7632fad14473364b374471f0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
ResumeThread
RtlMoveMemory
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
VirtualProtect
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ