00204b255c794a683d85c65d993de9d0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00204b255c794a683d85c65d993de9d0N.exe
Size

58KB
MD5

00204b255c794a683d85c65d993de9d0
SHA1

f68f85089a6642a8d201290a49229978e0532414
SHA256

f795c58723fd4bf8c436713841df6742166389c08e3c4293976f563ae399bdd1
SHA512

22d4ce0f25e238125eafea63149968272ff9912da4d1b42f7750b8be1c65dd40fc38ee6e6a2edd7f9b3f5997a1c9c9a02b7f70e699e97f60335d7dce206a7fed
SSDEEP

1536:2Hf56m+OTvlyqLcdxecPHzIvQ2Ttq0WcuHFzFgfPuN+X:2Hfsm7B5ursvQH8qxgfWE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00204b255c794a683d85c65d993de9d0N.exe

Files

00204b255c794a683d85c65d993de9d0N.exe
.exe windows:4 windows x86 arch:x86

7ff358545292f40a7b49f7d7c3c0f2bc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToLocalFileTime
GetProcessHeap
lstrcmpiA
lstrcmpiA
lstrcmpiA
DeleteFileA
Sleep
SuspendThread
GetVolumePathNameA
lstrcmpiA
CreateNamedPipeA
GetLogicalDriveStringsA
WaitForSingleObject
GetDriveTypeW
GetModuleFileNameA
IsValidLocale
GetStdHandle
HeapCreate
lstrlenA
SetLastError
CreateMailslotA
lstrcmpiA
GetModuleHandleA

riched20

CreateTextServices
IID_ITextHost
IID_IRichEditOle
RichEditANSIWndProc

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rts
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ