b6cf1acea634ed5bfcb5bdbd666c7bccd8ada58296ca1846f874dff2729378c1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6cf1acea634ed5bfcb5bdbd666c7bccd8ada58296ca1846f874dff2729378c1
Size

1.5MB
MD5

c7e4c583f888e8e0fbdfa379bb0fcd51
SHA1

278e7b89ce1b132906f78b01bffc3948df2f4a79
SHA256

b6cf1acea634ed5bfcb5bdbd666c7bccd8ada58296ca1846f874dff2729378c1
SHA512

0e75980a7375d3dd058c09e00e5ffef28866a1d61523a6acfaf4084e0a689e90808ca732f1592c05e61fbba591db4c5e1640bfa9bde3aaf415a12c3b0bf1028f
SSDEEP

24576:/l8yn+T/zBQZPFoLxc914oJnLaCMkSxX65UGXDT0yp:Gyn+TzCtFKxcj5MX65UGXDTT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6cf1acea634ed5bfcb5bdbd666c7bccd8ada58296ca1846f874dff2729378c1

Files

b6cf1acea634ed5bfcb5bdbd666c7bccd8ada58296ca1846f874dff2729378c1
.exe windows:5 windows x86 arch:x86

87f8c706d2ab64d430eb6b4bd8040590

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW

user32

CloseClipboard

gdi32

CreateFontW

advapi32

RegEnumKeyExW

ole32

CoInitialize

oleaut32

VariantClear

ws2_32

WSAStartup

crypt32

CertFreeCertificateContext

fltlib

FilterFindClose

Sections

.text
Size: - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upx0
Size: - Virtual size: 1015KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.upx1
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upx2
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ