bdc9e657c1443c32631a06009874f96fd97eabb40870710228cbb088954cfd3c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bdc9e657c1443c32631a06009874f96fd97eabb40870710228cbb088954cfd3c
Size

62KB
MD5

11fb05b570afda71a5ad6dd41498021b
SHA1

d5bf013096dfde41c809c3fe734f0df3622b3972
SHA256

bdc9e657c1443c32631a06009874f96fd97eabb40870710228cbb088954cfd3c
SHA512

855988f154566c2c2d29df291489bdcf1c6a58d7c89a87d60da58b89a314ba0967006c9e75e7342924956003b0e9ea4939f22cbee95be7f033ee31344aab280e
SSDEEP

1536:i4mqQ9yAfWC/BOtZMAwYdQqWIEvPL1QJg3mrieQVPVsJ3FQ1:f8hYRsvPL6JOmr0iQ1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdc9e657c1443c32631a06009874f96fd97eabb40870710228cbb088954cfd3c

Files

bdc9e657c1443c32631a06009874f96fd97eabb40870710228cbb088954cfd3c
.exe windows:4 windows x86 arch:x86

c45f76e414b028041c150ffca337bde2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerRegisterFile
ApplicationRecoveryFinished
OpenEventA
Heap32Next
CreateDirectoryTransactedW
PssCaptureSnapshot
FindNextVolumeA
GetConsoleCommandHistoryLengthA
RtlFillMemory
CreateEventExA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE