68474d6fc4cac10a8740f5475745e3de1ba225a14c4e34924c03dfff6dbdb65eN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68474d6fc4cac10a8740f5475745e3de1ba225a14c4e34924c03dfff6dbdb65eN
Size

1.4MB
MD5

a75c60dbedbf27c67853509917182c00
SHA1

4c6427fc1d9ed54cfd1dc687e9e4d2c8dab477c2
SHA256

68474d6fc4cac10a8740f5475745e3de1ba225a14c4e34924c03dfff6dbdb65e
SHA512

520a0bf1d3d70b9a43df17e7e001c029977f1546decdae16afc3621417d647eb00e04d2152a26aa2cba8ee170a94aeecc4cdf2ec740fc40d70161ada11e8440f
SSDEEP

24576:VA7b0u/nBWMIlA+1xxQpixeR1g9nwprluW7KDWVtApHFzthp8uj1pLbxyt8MiR+Y:Qb/n/IlA+1xxZxeR1g9nGrlluyVtOhhp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68474d6fc4cac10a8740f5475745e3de1ba225a14c4e34924c03dfff6dbdb65eN

Files

68474d6fc4cac10a8740f5475745e3de1ba225a14c4e34924c03dfff6dbdb65eN
.exe windows:4 windows x86 arch:x86

8b91600219abd08354f06e862e5a5b53

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupAccountNameW
EnumServicesStatusA
QueryServiceStatusEx

ole32

CoRevokeInitializeSpy

ntdll

RtlInitializeContext

kernel32

LocalReAlloc
GetCurrentProcess
GetSystemDefaultUILanguage
GetProcessHeap

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE