8e756c27dd10fc93b643e2ed1682d432226f77b8021315101548de034f9708e9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e756c27dd10fc93b643e2ed1682d432226f77b8021315101548de034f9708e9
Size

168KB
MD5

d30c4f3551e795553df9294599479689
SHA1

76ea95463d5d4a8d3557b868d42faa4c59c847ca
SHA256

8e756c27dd10fc93b643e2ed1682d432226f77b8021315101548de034f9708e9
SHA512

d5b1f09cf58ebbc1bd8f8e1d9948940ace7f51d5620306d7202dd386d41e201269348672b888d68db6997bff241447fa46f53c4c7e1d959c3ee4b0e4f834062c
SSDEEP

3072:Sv7sfCov+GC8Oxp8MLye7trHihlNg7BqYnP:6Nov+HhHqgjP

Score

N/A

Malware Config

Signatures

Files

8e756c27dd10fc93b643e2ed1682d432226f77b8021315101548de034f9708e9
.exe windows x86

3709f4e67da84c824f5a84036b744c79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwUnmapViewOfSection
NtQueryInformationProcess
ZwCreateThread
memcpy
memset
RtlUnwind

kernel32

SizeofResource
WriteProcessMemory
GetModuleFileNameA
LockResource
VirtualAllocEx
FindResourceA
SetThreadContext
LoadResource
GetCurrentThread
VirtualFree
VirtualAlloc
ReadProcessMemory
CreateProcessA

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE