27f350a73945b5cd17ae955cfb9b8ea0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27f350a73945b5cd17ae955cfb9b8ea0N.exe
Size

63KB
MD5

27f350a73945b5cd17ae955cfb9b8ea0
SHA1

87b87b5fcab74b6af40213d38c74074b316885cd
SHA256

25189cc703289b1bfe63bfd273cbee1b863c2a597fd567d3180538c288e8a55e
SHA512

d8a76c4cd5515b3fb4f26efddf6c29153fef9de7d9e8aa53bf7067d7caa11302ca633b55761130d25fbc8dbe301d8e261df8237d5808cbecef8992917979865a
SSDEEP

1536:y76HVNlQ587yvjy3iyoKEcxxt+Q17OI+ibpvAyhEwPy29Y:ycVJyW3iCV7tXXfbphhEwPyT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27f350a73945b5cd17ae955cfb9b8ea0N.exe

Files

27f350a73945b5cd17ae955cfb9b8ea0N.exe
.exe windows:4 windows x86 arch:x86

79717033d91358083c4f239c14d08da6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDEPPolicy
GetPackagesByPackageFamily
NtVdm64CreateProcessInternalW
QuirkIsEnabledWorker
InvalidateConsoleDIBits
IsBadStringPtrW
GetThreadPriority
GetCurrentDirectoryW
_lclose
GetConsoleMode

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE