e1dd778b32ea158c87aaa5241f0c8ce6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1dd778b32ea158c87aaa5241f0c8ce6
Size

239KB
MD5

e1dd778b32ea158c87aaa5241f0c8ce6
SHA1

5d7557d4c713862afb362f485708fe8aa642a9c2
SHA256

51b3783cf5be229f7beb03e5a561c493acf2669b421c0fa6e4bce59acf7d19c4
SHA512

9d380e7115189c527ab80d97e6ce371dd3c6d2c12df83510bfcd1d4992b3a732f6a873dd976c8c34e90665d4d14d0073c21f3fc37744bcc6ce53d474f688eac8
SSDEEP

6144:Du8d1n1v8vvqlOMVIiK31iNXy6SIKJ4mWNcI:Dz11v0vqMDiK3QpyhxecI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1dd778b32ea158c87aaa5241f0c8ce6

Files

e1dd778b32ea158c87aaa5241f0c8ce6
.exe windows:5 windows x86 arch:x86

e2dd3cc4052417fb02c4b813e9b908f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetFileTime
lstrcpyA
GetCurrentProcess
CreateEventW
Thread32Next
GetLocalTime
LoadLibraryA
GetVersionExA
CreateMutexA
DebugActiveProcess
DeleteAtom
GetCurrentThreadId
CloseHandle
GetConsoleWindow
CreateJobObjectA
GetFileAttributesA
GetProcessTimes
WinExec
CreateEventA
GetLastError
GetACP
LoadLibraryW
SetEvent
GetSystemTimeAsFileTime
GetProcAddress
IsBadReadPtr
VirtualProtect
VirtualProtectEx
VirtualFree
VirtualAlloc
FreeLibrary
WaitForMultipleObjects
lstrcpyW

advapi32

CryptGenRandom
CryptAcquireContextA
CryptReleaseContext

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 345KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ