681d6409e59b5124f067af19a0e09cd3a3e1d42280fd9c49b9f1f9103f8dc802 | Triage

Sharing

General

Target

681d6409e59b5124f067af19a0e09cd3a3e1d42280fd9c49b9f1f9103f8dc802
Size

904KB
MD5

79c17b72e51515a1b6f3022eb0de9ae5
SHA1

7c63a986a60dc4d57c610af6c51e0f58ed7bcd0c
SHA256

681d6409e59b5124f067af19a0e09cd3a3e1d42280fd9c49b9f1f9103f8dc802
SHA512

8a9bcb0163671085f1d2231bfee13a97307c6e305f49dfa65e4cf0a0f6644c8c636280686ac4f6c02c999ed0ac5e2ad843714498524b91fe437b8c53732b1e40
SSDEEP

12288:6rNYeUjOSWsaR0rkZfHNErB/+5x2uqbDasXp8saR0rkZfHNErB/+5x2uqbDasX:9QSv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
681d6409e59b5124f067af19a0e09cd3a3e1d42280fd9c49b9f1f9103f8dc802

Files

681d6409e59b5124f067af19a0e09cd3a3e1d42280fd9c49b9f1f9103f8dc802
.exe windows:4 windows x86 arch:x86

44ff0a852b40289ff2085cc27e8d026a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleW
GetStartupInfoW
GetCommandLineW
SetCurrentDirectoryW
GetModuleFileNameW
GetProcAddress
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
GetLastError
LoadLibraryA

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 484KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 400KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ