611ccdfec5648b5b5efec7d58ee7d3386a33d2d31567e40f8e71c16d1b3e024eN[.]exe | Triage

Sharing

General

Target

611ccdfec5648b5b5efec7d58ee7d3386a33d2d31567e40f8e71c16d1b3e024eN.exe
Size

567KB
MD5

03bef5716ae5e65a8fe44d9efb8057b0
SHA1

3bf498317057b0f03f78b23f0c10737257763662
SHA256

611ccdfec5648b5b5efec7d58ee7d3386a33d2d31567e40f8e71c16d1b3e024e
SHA512

da5070cfef33aabc374767c36dbd2b1cd8ad4d50d6658a494835f3aab1a05915233688c1f4d5173f380b592ae165fa4ccfc891941dcbcbed35dabcee15372919
SSDEEP

12288:EbhlwU8USMb7j1kBm3LQFtDKHl9MlcREd0E5MKuto5S15PLJikYN8f:O8IRSE6tDKlEd0E5xIoS15PLLk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
611ccdfec5648b5b5efec7d58ee7d3386a33d2d31567e40f8e71c16d1b3e024eN.exe

Files

611ccdfec5648b5b5efec7d58ee7d3386a33d2d31567e40f8e71c16d1b3e024eN.exe
.exe windows:5 windows x86 arch:x86

0424e8c0c58ea19c1114e523581cf387

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\Setup_9.1.2\Release_Win32\BabMaint.pdb

Imports

shlwapi

PathAddBackslashW

kernel32

FreeLibrary
LoadLibraryW
GetFileAttributesW
GetSystemWow64DirectoryW
lstrlenW
lstrcatW
ExitProcess
MoveFileExW
GetModuleFileNameW
GetProcAddress

user32

wsprintfW

shell32

ShellExecuteW
SHGetFolderPathW

Sections

.text
Size: 1024B - Virtual size: 569B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 823B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 564KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE