9c17c38bef5ef9a739f628103531f1c402694ed6ec11cc5fcce0b75ae73a94d5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9c17c38bef5ef9a739f628103531f1c402694ed6ec11cc5fcce0b75ae73a94d5
Size

63KB
MD5

41b48d23c49b75836571fbd899e2024e
SHA1

d6d4f3d68f1426a1f99af4ed1720911da8ca5114
SHA256

9c17c38bef5ef9a739f628103531f1c402694ed6ec11cc5fcce0b75ae73a94d5
SHA512

a92507ff5beb1ac7c085f01466a0362d692706759efe73cfb1607b76da9d67a51f105382c596ff34a9e0a933b10cd7e37119ed84d4adb66798404530e1b32884
SSDEEP

1536:HHklaBwM+/tDBk7fVWXcl+szXDNRXNEF9:HEubV7dWXyjzXDNRXNEF9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c17c38bef5ef9a739f628103531f1c402694ed6ec11cc5fcce0b75ae73a94d5

Files

9c17c38bef5ef9a739f628103531f1c402694ed6ec11cc5fcce0b75ae73a94d5
.exe windows:4 windows x86 arch:x86

b41778cb51ef98f99233f5c276ffa297

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Toolhelp32ReadProcessMemory
DeactivateActCtxWorker
GlobalFindAtomW
GetThreadInformation
AddDllDirectory
ScrollConsoleScreenBufferA
lstrlen
WerUnregisterRuntimeExceptionModule
QuirkIsEnabled3Worker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE