e16ac0c67dbbb1b5878bee6b8a67381c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e16ac0c67dbbb1b5878bee6b8a67381c
Size

46KB
MD5

e16ac0c67dbbb1b5878bee6b8a67381c
SHA1

685f65f5bd9bf1cc1c962c4ab50adf400e52bca7
SHA256

eee4f198e1e7866adcc7eb2e0cf697e741ddd14d74569502e899a0f36cd4103f
SHA512

6df859901e8bdaca2c11f2378ae7e2f36e2501c33494d099dec40b3cd112ca106d20fbc16a7ca23720093aa2b14676bb732d0dff1a4b36bd41a3e3c6fb95e2ff
SSDEEP

768:BdPs1hVkGTD1kB6aMkBCPnh0euivvAClCPrZlj/G6xr/4W9mrR6BVqc2iL/s2smv:nPvGdbJkBun9AIQrPj/zwW9mF63qzijV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e16ac0c67dbbb1b5878bee6b8a67381c

Files

e16ac0c67dbbb1b5878bee6b8a67381c
.exe windows:5 windows x86 arch:x86

499b1d50da543ccc9ccc37e5b16c88f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
wnsprintfA
wnsprintfW
wvnsprintfW
PathMatchSpecW
StrCmpNIW
StrCmpNIA
PathFileExistsW
PathRemoveFileSpecW
StrStrW
PathFindFileNameW
SHDeleteKeyA
wvnsprintfA

advapi32

RegDeleteValueA
CryptReleaseContext
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptCreateHash
DuplicateTokenEx

Sections

.heh
Size: 36KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svmj
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jcfqt
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ