64063bc12e6916d78f69d4a25eda1710N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

64063bc12e6916d78f69d4a25eda1710N
Size

54KB
MD5

64063bc12e6916d78f69d4a25eda1710
SHA1

28651e6dd2553dcce96d618169130145594aafad
SHA256

73cb407e6c481f6f915b6eb1698c7b0e547fe8b30d3e5e2689a50d693e0902e3
SHA512

7225547b6b8cfd538ec7bcc2aa0ccd11308d9ce783bb884e8f8068cb5a412b5e510abc09a370cb5dd42244b15d24cdd71362789d5bb699bbdc12f640a7b99363
SSDEEP

768:373OtJDvhzNsyXk58sCuSw26eWp12hzORvmGpsmC2317dRpr4Z:3a/DvVNe58kSw2tw21ORvmgDxZ4Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64063bc12e6916d78f69d4a25eda1710N

Files

64063bc12e6916d78f69d4a25eda1710N
.exe windows:5 windows x86 arch:x86

bbc712c81dbe5f313d887223f25de84e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetStartupInfoW
RtlUnwind
DecodePointer
EncodePointer
EnterCriticalSection
ExitProcess
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetOEMCP
GetProcessHeap
GetSystemPowerStatus
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
OutputDebugStringW
SetLastError
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ