868e50731ea706ff867e89ac4190edbbc99c06b04d4d833660b67f89cb109afdN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

868e50731ea706ff867e89ac4190edbbc99c06b04d4d833660b67f89cb109afdN
Size

152KB
MD5

cd166e46d5553dc51b0605aa01a6c6c0
SHA1

a3c97adb19728defb74b795cdcb1b8e8b6454cd4
SHA256

868e50731ea706ff867e89ac4190edbbc99c06b04d4d833660b67f89cb109afd
SHA512

cc6f16aed992ef3bb65e51ae03f346270a7f023c86b2e514c59b99eb6839c1411da0d85d786f746833efad4951f1a94c39a1322be46b8fa27836e6586c9231b0
SSDEEP

3072:l9fHY8Zx2lQlBwBkUF6/M8cmWIw47ouDN:lpH3Ez6k8cJIw48ux

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
868e50731ea706ff867e89ac4190edbbc99c06b04d4d833660b67f89cb109afdN

Files

868e50731ea706ff867e89ac4190edbbc99c06b04d4d833660b67f89cb109afdN
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ