d390a02ecbfc502066f6064e70b59e80N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d390a02ecbfc502066f6064e70b59e80N.exe
Size

17KB
MD5

d390a02ecbfc502066f6064e70b59e80
SHA1

8c59f5177da6300d80a886416519edb550d8ce09
SHA256

7f5434d9c6e753aa9d04226502a556df7d19c3c3024c84635a9f8bcd8e9a5eeb
SHA512

e9bab1aef5b367ca9d0184c718718b5a9c830929aa08fe2622ea527148f584e80484f86e0fae155639e3995673d1c8a650e251f6436e9b72a8ecd93a2266c574
SSDEEP

384:6FPophxdcmZO2Zp+Nye8pqrmub8TyztsDN:6FcxdoKK8o8TyJc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d390a02ecbfc502066f6064e70b59e80N.exe

Files

d390a02ecbfc502066f6064e70b59e80N.exe
.exe windows:4 windows x86 arch:x86

1e4c0da5737da53aff5e6e0ab7de1efa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
ExitProcess
OpenMutexA
Process32First
Process32Next
Sleep
CreateToolhelp32Snapshot
CreateMutexA
CopyFileA
OpenFile
CloseHandle
FindClose
FindFirstFileA

advapi32

RegOpenKeyExA
RegCreateKeyA
RegCloseKey
RegSetValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE