26bca18c8e40ff95615ac4fb9815e680N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26bca18c8e40ff95615ac4fb9815e680N.exe
Size

712KB
MD5

26bca18c8e40ff95615ac4fb9815e680
SHA1

e72bb6839f05076e2ccaad08e046545c2e374ce0
SHA256

fc25d8ee3e2fdc4c0ed9749679cf8fb30c2e394ea655695f7255e17131440778
SHA512

ceef65b7843d3728e3094db9902f1f56963dafda23e8cd16a0e166d5c32d6b49c67408462d36a433b522491d3d74b6b9901c00f6fd706acafd5a8f64f74459d9
SSDEEP

12288:w5hAPjVQDNwwkBr/kS6jtmw1Bp3FkKwE31iV74uDqXYDvL:wgq2wkp4BmuFKE1c4MnDv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26bca18c8e40ff95615ac4fb9815e680N.exe

Files

26bca18c8e40ff95615ac4fb9815e680N.exe
.exe windows:5 windows x86 arch:x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 471KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE