ca5054d8dab63149f2956f6df1075090N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ca5054d8dab63149f2956f6df1075090N.exe
Size

239KB
MD5

ca5054d8dab63149f2956f6df1075090
SHA1

883ebd6cdc9e877764dae909f317b10f5043b43e
SHA256

d5bc5bf43eb862c604ce0b79ffea9b9be3b21a3af2747023559d51d334c59887
SHA512

d143603ca9a5e3c48940f17a3d0b1455d1294564a36390372114db8fa54125c902940cf377b41ca21986b8b2b27fe86a56051c2792fcbc5a9df6b5f6856b1c0d
SSDEEP

6144:8L8gI6pHMl4xmlvs/8NDVc7goKaCZlhuq:8LBnMl4xwRxugo7C5uq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca5054d8dab63149f2956f6df1075090N.exe

Files

ca5054d8dab63149f2956f6df1075090N.exe
.exe windows:4 windows x86 arch:x86

e4563b2e65fc5d4b5661a5b63d45b0e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
SetWindowTextA
CreateWindowExA
SendMessageA
RegisterClassExA
PostQuitMessage
GetMessageA
FindWindowA
DispatchMessageA
DefWindowProcA

kernel32

GlobalReAlloc
LoadLibraryA
GetProcAddress
WaitForSingleObject
Sleep
SizeofResource
SetEvent
LoadResource
GlobalLock
GlobalFree
GlobalAlloc
CloseHandle
CreateEventA
CreateThread
ExitProcess
ExitThread
FindResourceA
GetModuleFileNameA
GetModuleHandleA

winmm

mmioAscend
mmioClose
mmioDescend
mmioOpenA
mmioRead
mmioSeek
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ