68872ea7a83eaabc12d304a00b907d40N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68872ea7a83eaabc12d304a00b907d40N.exe
Size

2.5MB
MD5

68872ea7a83eaabc12d304a00b907d40
SHA1

619391f859efbf227ace251fadfd1a23ebea2756
SHA256

5a314690dadc9618c1cdab6812499ef9c217ff15b0ec36fa69bfd68d85f371a4
SHA512

7bef29169fd905023a6c4b5bbb2b6cc55a0b20f68e55ec2203017868785df278a347418054dc80be34e50b2e24ed0600f9c2a909e3ba17f62ed2da0da216efc9
SSDEEP

49152:G4aq6FjT6S/zpJNntwwk49qJQMKu5k+mCi1JmQxjXcElObBdQFtB:GM6VZpJNnu4MKtCijtNXpezQ3B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68872ea7a83eaabc12d304a00b907d40N.exe

Files

68872ea7a83eaabc12d304a00b907d40N.exe
.dll windows:5 windows x86 arch:x86

d27f6f9c457b082f6a7b29043ab96a28

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameW
GetBinaryTypeW
ReadConsoleA
LoadLibraryExA
SetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
EnterCriticalSection
LocalFree

gdi32

InvertRgn
GetLayout
EndPage

msvcrt

strspn
putc
wcscoll

esent

JetRetrieveColumns

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA

wintrust

CryptCATAdminReleaseCatalogContext

user32

ExcludeUpdateRgn
GetOpenClipboardWindow
MoveWindow
ToAscii
GetUpdateRgn

Exports

Exports

RlosreenhaH

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ