d6b952d10e0c8f7dd5e716bac678eb50N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6b952d10e0c8f7dd5e716bac678eb50N
Size

63KB
MD5

d6b952d10e0c8f7dd5e716bac678eb50
SHA1

6f5e2647672c335302f4833708af3b47275b2f6b
SHA256

ea61313cae2b1dac3398ccd5b3e556d56a0e60a9170db5677b887d793e1f7ee0
SHA512

91d5932713e56afed31247dce5eb691177c374d9ff1bb3c1d7314425f5497de0dd3f6ec5f3eb47f00cd47046ad4b926c3057a1c5be7934181d36baa0561b67a1
SSDEEP

1536:kCQlypO/moAzBq9bkcDx+ZajAmplyIX3JfYuut4ndAld:9YhzAlqRXjAOlymt8xld

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6b952d10e0c8f7dd5e716bac678eb50N

Files

d6b952d10e0c8f7dd5e716bac678eb50N
.exe windows:4 windows x86 arch:x86

633860524ffe95eeec55a71547c7c897

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionW
EnumDateFormatsExW
GetSystemWow64DirectoryW
GetNamedPipeHandleStateA
IsValidLocale
IsProcessInJob
lstrlenA
ZombifyActCtx
SetConsoleCP
GlobalGetAtomNameA
GetExitCodeThread

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE