b006871bada98861d558f71881f25dd880c3430a07fcf090dfe57c178fd35015 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b006871bada98861d558f71881f25dd880c3430a07fcf090dfe57c178fd35015
Size

63KB
MD5

d58b116f143950e8399a671417d33989
SHA1

26b889ef15e7a076bac2c52645bef8613ff41402
SHA256

b006871bada98861d558f71881f25dd880c3430a07fcf090dfe57c178fd35015
SHA512

6847590c386ebecdc2b3263c0fce6421ac9b2ff22102d30b783ec3b1084b7f7689f508acb4428c85d10751171038beaaa687b975bd22e09620ce883e93a8d0d4
SSDEEP

768:ObfU9Gl4c8HxECOSOj+MVb20qQkRBoOQoqJCzY0G56pRocfAfvRSFUH+W90D9gMw:MfsKpI+dHuT/40E+cWykrpimG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b006871bada98861d558f71881f25dd880c3430a07fcf090dfe57c178fd35015

Files

b006871bada98861d558f71881f25dd880c3430a07fcf090dfe57c178fd35015
.exe windows:4 windows x86 arch:x86

61f6641b0e85b33be11fd08713d58dbc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNumaAvailableMemoryNode
ReadFile
SetConsoleInputExeNameW
QueryActCtxWWorker
FindNextVolumeA
EscapeCommFunction
TransactNamedPipe
SetThreadpoolStackInformation
GetVolumeInformationW
Heap32ListNext

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE