be19254ab2868916380284a1b89373993e3d9110e569141f67017436d15a89e7 | Triage

Sharing

General

Target

be19254ab2868916380284a1b89373993e3d9110e569141f67017436d15a89e7
Size

3.2MB
MD5

782834c20b3c2c393f4a913f2b5742e8
SHA1

858cab6c4f353224345c033dcfba0b33950e1168
SHA256

be19254ab2868916380284a1b89373993e3d9110e569141f67017436d15a89e7
SHA512

f104a0fddd17bd30fc52b62376fe40b0cbb23beaab0746bb49c2bd2771cc0caf0e2eb5ef8ed5cff0d98b6708c898d3ca52bb856c0c6dc874b66c2cf2d586d83b
SSDEEP

49152:nnyN1rnv/cGbfHlULG/zVkIbowR0cmd1vVjm8uOPdsFo:mhuWzSI0wR0cm/Fm81uo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be19254ab2868916380284a1b89373993e3d9110e569141f67017436d15a89e7

Files

be19254ab2868916380284a1b89373993e3d9110e569141f67017436d15a89e7
.exe windows:4 windows x86 arch:x86

b144870e3a37e200b228432e9ff61d95

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
CloseHandle
QueryPerformanceCounter
ReadFile
SetFilePointer
CreateFileA
ExitProcess
GetModuleFileNameA
Sleep
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE