970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b | Triage

Sharing

General

Target

970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b
Size

5.3MB
MD5

71298c6267e75829a010d4f9865eee4e
SHA1

899760242eb69420c42e7b051dc5d067c8af76ea
SHA256

970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b
SHA512

e7e1c8c7751fb7216f1d70ed6f2001a8a9f6e9e9709874b4fe6980a6d31feb6ee9d46d9dae065bbb29e46c9829b638c1171f09d719618a628d79750292fa8677
SSDEEP

98304:ZMKKkv47Ffneb2RjDv4w0ZXpIY0icDJZDMM/mo1:ZMKKkv4pneb2pEjSJZp51

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b

Files

970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

_CreateLexer@4
_GetLexerCount@0
_GetLexerFactory@4
_GetLexerName@12
_GetLibraryPropertyNames@0
_GetNameSpace@0
_LexerNameFromID@4
_SetLibraryProperty@8

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 645KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ