9e9787b804790826acd1ebf7758769d07d7c73e8317a0fec51189c3f177d5486 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9e9787b804790826acd1ebf7758769d07d7c73e8317a0fec51189c3f177d5486
Size

6KB
MD5

c9b645d960f15e1b5c8ad4b6cc5de2f7
SHA1

60895912cd70e1d23dad094f68f42742ce5ac607
SHA256

9e9787b804790826acd1ebf7758769d07d7c73e8317a0fec51189c3f177d5486
SHA512

e6b7a354aa0a86f719c254f2b7d62b0e5e84b81d8c0ddb7f2795a485aa1c7f20fd36cc1be568c48af3baf8f6c94d66f8e6586f79e432ba39ca684d27bdc2d04f
SSDEEP

48:Snbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uAO:C0mIGnFc/38+N4ZHJWSY9FI5WqJx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9e9787b804790826acd1ebf7758769d07d7c73e8317a0fec51189c3f177d5486

Files

9e9787b804790826acd1ebf7758769d07d7c73e8317a0fec51189c3f177d5486
.exe windows:5 windows x64 arch:x64

7c5f9b19847a4e36080308f0e2c5add5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CloseHandle
VirtualFree
GetProcessHeap
CreateFileMappingW
MapViewOfFile
OpenProcess
UnmapViewOfFile
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ