def6d494d68d8a5068cb8cf5c4649656 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

def6d494d68d8a5068cb8cf5c4649656
Size

36KB
MD5

def6d494d68d8a5068cb8cf5c4649656
SHA1

96dd27a97d6f949192fe46bfb70253fdd89b9db7
SHA256

c1bade7b19b5f462880d7e7a4cabf4cdc70c3f24f9e7468003fb4cfc45340bc9
SHA512

f44949161162adf857d0f65c9d485eb5ec51cea5f3f0dd20fb6a07a3422da06e7ff29f0a2d5eb4f6ac2f2da68ce5263fd46a2d7241c1a47d22969ba8f04c1eb5
SSDEEP

768:z8b2ni1IdScG/5B/06TAfVZvN8562/eGAQgp:z8JudNN856K8p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
def6d494d68d8a5068cb8cf5c4649656

Files

def6d494d68d8a5068cb8cf5c4649656
.exe windows:4 windows x86 arch:x86

e2b072c5875b4edeb271296bc266e4a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord518
ord593
ord594
ord598
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord607
ord608
ord715
ProcCallEngine
ord645
ord571
ord685
ord100
ord616
ord617
ord581

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ