6404bf80a52a1658168191ca535bd28f2337996de6108e00fe0855db68bb34b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6404bf80a52a1658168191ca535bd28f2337996de6108e00fe0855db68bb34b7
Size

346KB
MD5

dcef66ea0d44fe17daedd6275556107d
SHA1

059ebe52e99d75d8297f47d7c9083fa5a563fe00
SHA256

6404bf80a52a1658168191ca535bd28f2337996de6108e00fe0855db68bb34b7
SHA512

52ad57f76e67652abefcd30449811ef5de26d7a3d65d488e3d71d99d410cc058e51b2be62dc04ff8b36e4d64135f3c5c25dc7eda54755fa21590d7a045a993be
SSDEEP

6144:w0LSdWk/13OJA2p8WhEeF5qD+OEyA0ycIr+VLxzK0hhhvdDO60EqRp:w0md3/94A2p8GnqZycIr+VtKov46Oj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6404bf80a52a1658168191ca535bd28f2337996de6108e00fe0855db68bb34b7

Files

6404bf80a52a1658168191ca535bd28f2337996de6108e00fe0855db68bb34b7
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

E:\delivery\Dev\wix36_dev11\build\ship\x86\x86\burn.pdb

Sections

.text
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ