8b4d0acfc0e0be025f652119bee011f0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b4d0acfc0e0be025f652119bee011f0N.exe
Size

1.3MB
MD5

8b4d0acfc0e0be025f652119bee011f0
SHA1

161f63da469db3486ea86dd7c4d16cb8402935a5
SHA256

44bcbcf65382c727c2fc12687ee444c1b4b9d27efa5c23a507cdf6ac32e4b59f
SHA512

8314397e3194a3533b350de141117312058e1978287f8d5e911bdcffe2ca71da90bff50c8e775fda754f3006b41fea0ce6c3ff1dde6722c38b01b00311f9f8be
SSDEEP

24576:WhMkxlRSaiPDi3+kfxpOtUrmRAdU5kGw3:9kkP+Ok/WuUw3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b4d0acfc0e0be025f652119bee011f0N.exe

Files

8b4d0acfc0e0be025f652119bee011f0N.exe
.exe windows:4 windows x86 arch:x86

8c8cd2fe8f466202b9cc82f6156dad3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
CloseHandle
Sleep
ReadFile
SetFilePointer
CreateFileA
QueryPerformanceCounter
ExitProcess
GetModuleFileNameA
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
GetStartupInfoA
GetModuleHandleA
HeapReAlloc
GetCommandLineA

user32

wvsprintfA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ropf
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ