d243c130547c769897f0d6e9a0b50120N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d243c130547c769897f0d6e9a0b50120N.exe
Size

56KB
MD5

d243c130547c769897f0d6e9a0b50120
SHA1

e9ee93932ed5869e901cb324d774ab8cfd841f99
SHA256

33fa5c9e41274680042cd0114fe2fe7c98ade28dcbcbb2147ca3d6dd0edc94d8
SHA512

daea49d9841de44f13c4c30b17bb89ff38f24d42f1a93fddfdd69b923fb68b8e93db2f4fba05266f7bb6af08e2663896bc27dd7d94b63aebe6d8f37c7148bca4
SSDEEP

1536:YOD1a07JWg69BlvsxlbZqkT5AGJq/tqr9BKei:YOh7JWg6xvsxRZqk1AG8/EA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d243c130547c769897f0d6e9a0b50120N.exe

Files

d243c130547c769897f0d6e9a0b50120N.exe
.exe windows:4 windows x86 arch:x86

a1a93c330f3c33bcff6d077be43e9d66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

timeGetSystemTime
BasepCheckWebBladeHashes
TermsrvSetKeySecurity
VirtualLock
RegLoadKeyW
LCMapStringEx
CloseThreadpoolIo
MapUserPhysicalPages
LocalCompact
Sleep
QueryIdleProcessorCycleTimeEx

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE