648431bd395ada64d217074989f0c4e0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

648431bd395ada64d217074989f0c4e0N.exe
Size

44KB
MD5

648431bd395ada64d217074989f0c4e0
SHA1

c388b9a19dbb3b5e3b07d507111681f64e34c2b0
SHA256

ab554751be4c124910ce2c30b4af01696d8a4d958b167819f7863ff667599e11
SHA512

92f6e6b48e3ae35c1ffcd8b53721f8f2c45474274dd9ebc95c2c7da8aa61d82041802374248b30a8f6fb84c282b758469cb50e502da0cd5b2f1f968e87a8f3dc
SSDEEP

768:MApQr0ovdFJI34eGxusOy9Rp1pLeAxoeC48PqK1Wn2F:MAaDJlMsh7pWezC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
648431bd395ada64d217074989f0c4e0N.exe

Files

648431bd395ada64d217074989f0c4e0N.exe
.exe windows:4 windows x86 arch:x86

7ecd8f76627cb5379a7c0b0c02b48c9c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
MoveFileW
GetSystemDirectoryW

shell32

ShellExecuteW

msvcrt

_wstat
_exit
exit
wcscmp
wcscat
fclose
memset
fread
fseek
_wfopen
fwrite
wcslen
wcscpy
wcsstr
__p__commode
wcsncpy
__p__fmode
_XcptFilter
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__set_app_type
_except_handler3
_controlfp
_wcslwr

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.htext
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE