f1b3b18917aee4f0582476f21dd49cc8885efb20ecc08344c549bd5b6ea50a5cN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1b3b18917aee4f0582476f21dd49cc8885efb20ecc08344c549bd5b6ea50a5cN
Size

301KB
MD5

00f6b764564fc9b7477ba9dbb722fb30
SHA1

480a6d2eb038814524774f495f39f6ca96ada295
SHA256

f1b3b18917aee4f0582476f21dd49cc8885efb20ecc08344c549bd5b6ea50a5c
SHA512

acfc9f8709d656f37862b0bd9c9604ebafe919f8e4452dc8a4fa0ccb7369197be39fe261b4512b47648d3062b85b37f4c5222ed8644c6f49007a9af0fb7594a6
SSDEEP

6144:LuRKMDCFjXfToEsWHIwoRvxck6QcUaEOMhWrXE:cAvTliCTUaEOcu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1b3b18917aee4f0582476f21dd49cc8885efb20ecc08344c549bd5b6ea50a5cN

Files

f1b3b18917aee4f0582476f21dd49cc8885efb20ecc08344c549bd5b6ea50a5cN
.exe windows:4 windows x86 arch:x86

61b2d38bfe44d497c6e666db458c90e7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeW
GetModuleFileNameA
lstrlenA
lstrcmpiW
WaitForMultipleObjects
GetProcessHeap
lstrcmpiW
SetLastError
GetStdHandle
lstrcmpiW
Sleep
IsValidLocale
OpenMutexA
DeleteFileA
lstrcmpiW
FileTimeToLocalFileTime
lstrcmpiW
CreateMailslotW
CreateNamedPipeW
GetVolumePathNameW
GetModuleHandleA
GetLogicalDriveStringsW
HeapCreate

scecli

SceOpenPolicy
DeltaNotify
SceSysPrep
InitializeChangeNotify

Sections

.text
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ