00495c0d967a79223dc83d819b6ac1c0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00495c0d967a79223dc83d819b6ac1c0N.exe
Size

37KB
MD5

00495c0d967a79223dc83d819b6ac1c0
SHA1

7ffc0c0f42dc9abdd4b4dbf5e7a688b44211f8d7
SHA256

fa50f3beb6656e568774321294826537880ed9d0a7ea167e45ba0efcc57e9f1d
SHA512

b8b5c5b9f711dffa64d818a43c58b476fce523b09538a52c41ed8239f85a5f3d94dd6bd5772b79b0404f5cdae5d9982e02f1d6c837082c4aa2366832e4d2c55b
SSDEEP

768:hCO/vpRcmsM2s1Jx8n/Sim6gBkCoeMtcng1aR2VYVM:QO/EmsM20O/5WBkCstkM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00495c0d967a79223dc83d819b6ac1c0N.exe

Files

00495c0d967a79223dc83d819b6ac1c0N.exe
.exe windows:4 windows x86 arch:x86

e3ab8b785f51ddd35b2e0a576a297161

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UnloadKeyboardLayout

advapi32

RevertToSelf

winmm

mixerClose

imm32

ImmDestroyContext

msvbvm60

ord584
ord695
ord441
ord556
ord669
EVENT_SINK_AddRef
ord674
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord717
ProcCallEngine
ord644
ord570
ord571
ord100
ord545

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ