264ffc6b6cb979b2dcbb6399c7ee94b08a4c8fe5b550c2e3e1b04bb76c550ab6N | Triage

Sharing

General

Target

264ffc6b6cb979b2dcbb6399c7ee94b08a4c8fe5b550c2e3e1b04bb76c550ab6N
Size

111KB
MD5

1885ff3a2f54cb857fb4b7275c14ef10
SHA1

7be7d2ea61053b32420b7d221787f792a12fe71a
SHA256

264ffc6b6cb979b2dcbb6399c7ee94b08a4c8fe5b550c2e3e1b04bb76c550ab6
SHA512

15231bddcdf2831920b19c24e62d8b76a9d1f38e24a6cb95dd37fbef64fec355fcc564aaab1a66bc62e2615ca9350397607667042027a7a64d805618f4f92b9c
SSDEEP

1536:kznh0ey5jTZWpwLrCziIK8+wv/O50y5FE2bdEGcToZAD56k8:ulyPL2zHoytG5dHJZE5d8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
264ffc6b6cb979b2dcbb6399c7ee94b08a4c8fe5b550c2e3e1b04bb76c550ab6N

Files

264ffc6b6cb979b2dcbb6399c7ee94b08a4c8fe5b550c2e3e1b04bb76c550ab6N
.exe windows:4 windows x86 arch:x86

d12457ed3dcd0510fcb6ec11cec6c1d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Each\Authenticated\By\Device\Your.pdb

Imports

kernel32

GetStdHandle
GetFileType
WriteConsoleW
SetLastError
LoadLibraryW
FreeLibrary
LocalAlloc
LocalFree
GetOEMCP
GetACP
MultiByteToWideChar
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetModuleHandleW
GetConsoleOutputCP
GetLastError
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GlobalAlloc
GetTimeFormatW
GlobalFree
VerifyVersionInfoW
VerSetConditionMask
GetCommandLineW
GetFileAttributesW
lstrcpynW
FindNextFileW
FindFirstFileW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetStartupInfoA

user32

CharToOemW
wvsprintfW
LoadStringW
IsCharUpperA
wsprintfW

gdi32

GetBkColor

msvcrt

puts

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ