e1b6d5917cb42b9e33d18a3ad7343b71 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1b6d5917cb42b9e33d18a3ad7343b71
Size

48KB
MD5

e1b6d5917cb42b9e33d18a3ad7343b71
SHA1

b91490f0cfe789a801ce23d519e3eb789c586f47
SHA256

76625090b28716653f70f2b6b27359b382ff871033708e57688d684a94889db8
SHA512

bf3f61074e191c8be2c8b11f5cc8fd1d4fe8db2472b34e562d319dd319383b579bb62156b846e6de6623909926047c9f63c400ebaa37e189bb5384213003a11c
SSDEEP

768:PYYCEjG/PNYlmecTQ74EJtl3+aa8i3cTtJkYxdvWAb9EAR1Y0PfDjLfc1nKfk44t:njG/PNYUQ74EJj+R8iKtKYxHbb1Y0XD8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1b6d5917cb42b9e33d18a3ad7343b71

Files

e1b6d5917cb42b9e33d18a3ad7343b71
.exe windows:5 windows x86 arch:x86

d37faf9145b4896b044c01e5d8f56d15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueA

kernel32

GetFileTime

shlwapi

PathCombineW
PathFileExistsW
PathRemoveFileSpecW
SHDeleteKeyA
StrCmpNIA
StrCmpNIW
StrStrW
wvnsprintfA
wvnsprintfW

user32

ExitWindowsEx
GetCursorPos
GetMessageA
LoadCursorA
MsgWaitForMultipleObjects
OpenWindowStationA
PeekMessageA
SetProcessWindowStation
SetThreadDesktop
ToUnicode

Sections

.tqz
Size: 38KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zyt
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zkt
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ