58a397aca6b579b259c61893b0865b439d4efbdb49e738c3d44556faa4a02651N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

58a397aca6b579b259c61893b0865b439d4efbdb49e738c3d44556faa4a02651N
Size

157KB
MD5

ebd56289bda63cf943f10bf5cd8f4230
SHA1

2c802f5f7e15b2762100ee482ac9c508e2d287f6
SHA256

58a397aca6b579b259c61893b0865b439d4efbdb49e738c3d44556faa4a02651
SHA512

731a2be99f0641a64ff6575867fbc56190888671cac443f02a633f2dfdea6c9eb682aea3d61b5e8d6eca0bc02d20930ea6ebc9b796b4128b7c446b2953c873de
SSDEEP

3072:WkZ3v0tH4ct+4gKalYtjyU7v7W32Nb038wHvEzRPw:bVAvhvyU7v/68w8zy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
58a397aca6b579b259c61893b0865b439d4efbdb49e738c3d44556faa4a02651N

Files

58a397aca6b579b259c61893b0865b439d4efbdb49e738c3d44556faa4a02651N
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ