a1e01f018de4aa1e2089955a8b0166c0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1e01f018de4aa1e2089955a8b0166c0N.exe
Size

962KB
MD5

a1e01f018de4aa1e2089955a8b0166c0
SHA1

d685db123ca54f257876eb6d0b720c8a9408bdfb
SHA256

ffd50c2804da071a7477e7ef9eb06eeb58a07f0fea147cfd218f820fbb9c5202
SHA512

2b2830a258378ca136ca39c717c32b8b9ae2009b1be1eac889077cd1d5b4a53b1879246a8c6515adc6b25589af87f8d9da284d07d8a3c014006d61bc5ef2bc74
SSDEEP

12288:ldUtTxYXVO6V23txRPu4RKQ75yrKjU8qqYG1krrd9CRFZQj6G/Nkdeno5zxtld75:l6Tu7V2dfVKEQZpqYLrw5kkwohxtB1f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1e01f018de4aa1e2089955a8b0166c0N.exe

Files

a1e01f018de4aa1e2089955a8b0166c0N.exe
.exe windows:5 windows x86 arch:x86

1d8495c0f3395d73b30ddc1676aa306c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

RegisterActiveObject

ntdll

ZwIsProcessInJob

user32

GetCursor
RegisterClassA
GetActiveWindow

shell32

RealShellExecuteExA

Sections

.text
Size: 959KB - Virtual size: 960KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE