d13e61be600d024002c93ddd20c75d50N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d13e61be600d024002c93ddd20c75d50N.exe
Size

49KB
MD5

d13e61be600d024002c93ddd20c75d50
SHA1

e30d76f9af1ed04d729fdc8dad97a2028208eca3
SHA256

7cc0197f8d024e8f888e135769e51ff0d393f62e07b0e6f450338e34669e5813
SHA512

d0d7bad924d3c4b8e1641dc6774961dc82a754facc42775f6dd3a5df02e9311e35e0509fc577b727ffe8b8c4a20989510e779c114e7e62d49760a8a5613667c9
SSDEEP

768:Erzfe4ewyX6RNHHVo0nDiZnLGcxeeFKiQ2vEIH:EHh7ueHVJcycxHh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d13e61be600d024002c93ddd20c75d50N.exe

Files

d13e61be600d024002c93ddd20c75d50N.exe
.exe windows:4 windows x86 arch:x86

e95e3c19c1b1846eddfe9b97188d572c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateFileA
CreateMutexA
CreateProcessA
CreateProcessW
DeleteFileA
ExitProcess
GetCommandLineW
GetModuleFileNameA
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
HeapAlloc
ReadFile
SetFileAttributesA
SetFilePointer
WriteFile

ntdll

NtFlushInstructionCache
NtOpenKey
NtProtectVirtualMemory

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE