ef7b886ebdb4f26137578fd3f75e561ed58a7f3b15af5f5f7078d2f898a12cfe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef7b886ebdb4f26137578fd3f75e561ed58a7f3b15af5f5f7078d2f898a12cfe
Size

52KB
MD5

0808fee43cfa86db9a7626f3727a9fc2
SHA1

db108f7c59843fceefe227ff732e95300aa88942
SHA256

ef7b886ebdb4f26137578fd3f75e561ed58a7f3b15af5f5f7078d2f898a12cfe
SHA512

bb6bba7b8248034007fac3af167f37405dc3fa25ebeea1b5103c9d352ff6ad9024c6f86b7b6fd1d8c1bce1f30ace68bb0e20b1b9cc2c0f525ce01f65f46f5023
SSDEEP

768:373OtJDvhzNsyXk58sCuSw26eWp12hzORvmGpsmC2317dRc9:3a/DvVNe58kSw2tw21ORvmgDxI9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef7b886ebdb4f26137578fd3f75e561ed58a7f3b15af5f5f7078d2f898a12cfe

Files

ef7b886ebdb4f26137578fd3f75e561ed58a7f3b15af5f5f7078d2f898a12cfe
.exe windows:5 windows x86 arch:x86

bbc712c81dbe5f313d887223f25de84e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetStartupInfoW
RtlUnwind
DecodePointer
EncodePointer
EnterCriticalSection
ExitProcess
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetOEMCP
GetProcessHeap
GetSystemPowerStatus
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
OutputDebugStringW
SetLastError
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ