356866b23cae0c979b4b2325b1c434b9fbd09673b8ee766f5a92686a668b0ebb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

356866b23cae0c979b4b2325b1c434b9fbd09673b8ee766f5a92686a668b0ebb
Size

14KB
MD5

aab9a949cbcf73ec226273cea0a8313e
SHA1

59fb7ecc0c47aac8e4e958a47478aa749481d3fd
SHA256

356866b23cae0c979b4b2325b1c434b9fbd09673b8ee766f5a92686a668b0ebb
SHA512

65ead5a7b21708dcfd165ac05ee9af4c87219514fc6eafdcc1bf88a1f39bfd26a3df561040efaa72299944f2135f0249a46602f80041c1fd498ee20b62c25497
SSDEEP

192:IOcrEQ8XZGMxpJSwZCbP3TSEmZH46A3CzYWu58u51Yxlghs3nnnnnn+:joELIeMNmXA3CzYd5r51Yxyh3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
356866b23cae0c979b4b2325b1c434b9fbd09673b8ee766f5a92686a668b0ebb

Files

356866b23cae0c979b4b2325b1c434b9fbd09673b8ee766f5a92686a668b0ebb
.exe windows:4 windows x86 arch:x86

0492baea297996815693da7f4b834882

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleFileNameA
DeleteFileA
CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
GetCommandLineA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
ExitProcess
GetModuleHandleA

user32

PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA

msvcrt

rand
strrchr
malloc
realloc
_ftol
free

shlwapi

PathFileExistsA

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ