de59039d96c5cc2da82607bb12156324 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de59039d96c5cc2da82607bb12156324
Size

258KB
MD5

de59039d96c5cc2da82607bb12156324
SHA1

83d54ff41910aea87e84885e0120d2178cbe254e
SHA256

e7a8cdaa750bfd666b81b57791162653abd16586a861cd2ba9a031309af4f63d
SHA512

c85688eac2fca58650e237e7c4f72bf66ff2b6e47a9a2cccdaf746a3147de7e0463a88b2d48c4939967ed26957b460a8ff832a44651bd58124cbc3b8e04a3572
SSDEEP

6144:lHULplmNLTCl2ZtH4mqq2AnPLjNLKRiH:lHICNxZemWmR3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de59039d96c5cc2da82607bb12156324

Files

de59039d96c5cc2da82607bb12156324
.exe windows:4 windows x86 arch:x86

d74af08b25e34adc349d1735728a0a22

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3

kernel32

WaitForSingleObject
CloseHandle
WriteFile
CreateFileA
CreateThread
lstrcatA
GetLastError
CreateMutexA
lstrcmpA
lstrcpyA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetModuleHandleA
IsDebuggerPresent
GetCurrentProcess
lstrcmpiA
HeapFree
GetEnvironmentVariableA
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetProcessHeap
lstrlenA
GetProcAddress

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE