00268c2480258bac2d7c336af8206c80N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00268c2480258bac2d7c336af8206c80N.exe
Size

91KB
MD5

00268c2480258bac2d7c336af8206c80
SHA1

4a29ad27ffdf7410a7f6012510a6811fd17c3f91
SHA256

3f92b7e40e3c2cdeec4bcebbc20f9ff5ec78a63167efd9b204a6956dc0b3a612
SHA512

c16f7477cb65fe46fdba922de5c9404cc00f7fc528bde6e9da782ec346a27901029f9a902646ade8936bcd896d291eaa2819ab48136f6defe4745ade96a4620b
SSDEEP

1536:RzQw4z/BeCFdhGinAqeuUVfjF3X53G1HcEz2y2sWtBuZ1nqdbi:1Mz/BeC1rQ53GmEgd2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00268c2480258bac2d7c336af8206c80N.exe

Files

00268c2480258bac2d7c336af8206c80N.exe
.exe windows:5 windows x86 arch:x86

e7aa198c15636f4f58b3b14d6517f11b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

ExitProcess
EnumResourceNamesW
GetCurrentProcess
QueryPerformanceCounter
GetModuleHandleExW
GetTickCount
GetCurrentThread
VirtualFree
GetProcessHeap
Sleep
ExitThread
VirtualAlloc
IsWow64Process
EnumSystemLocalesW

user32

MessageBoxA
MessageBoxW

winspool.drv

OpenPrinterW
ClosePrinter

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ