52c461bf9ee92f55147baf9557c52cbd83d4fd6b2d5e2f7727fec89837581c13 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

52c461bf9ee92f55147baf9557c52cbd83d4fd6b2d5e2f7727fec89837581c13
Size

157KB
MD5

f562e0e6ec838efa3e72b7e0f3bf7b09
SHA1

3c4e5c6ee5435c2b33b8be1a04dfc3b660b20c60
SHA256

52c461bf9ee92f55147baf9557c52cbd83d4fd6b2d5e2f7727fec89837581c13
SHA512

721bf44a17af5eb16dc11fd54064fb22595e62397914b801307189e85a8defc8b2554b28dd502cba915670266fa311a929e1701700f8e47ba23feea25f938120
SSDEEP

3072:OXWZffnl34DTjkw5dK09MsA1DRX//JCe1o4y/QFzz9l6rhLsKl:Omll34D2ppJCT4yYFz5srJn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52c461bf9ee92f55147baf9557c52cbd83d4fd6b2d5e2f7727fec89837581c13

Files

52c461bf9ee92f55147baf9557c52cbd83d4fd6b2d5e2f7727fec89837581c13
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ