tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

477KB
MD5

4fac556eceb3f6a6b28a39b7e555941b
SHA1

b8deb206996db5df0524d4328a03cec7178dfe0e
SHA256

31ca0502fe274d68c3da0efb2fa2584648c18f65697f0bf9be65559ff719e699
SHA512

509158cc2ab8036491393a8c677c65a7fdb47f526e65c71a7c2fd65ecf288a3c385f5f1a5cb9f22dd484e7332b35651dbd4f1143af0346e0be19944ab2677f08
SSDEEP

12288:ZjaaF2sTh5S3B8ZlNnYKF/DCeT2T8fltAPCB:oaF2eh5S3B8LNnhZT2T8flOPCB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows x64

606a690081d1bdedf2f5dc3cb5f1d4a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CloseServiceHandle
CheckTokenMembership
RegNotifyChangeKeyValue
SetSecurityDescriptorDacl
AllocateAndInitializeSid
RegCreateKeyExW
CopySid
IsValidSid
RegSetValueExW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
RegQueryValueExW
AddAccessAllowedAce
GetLengthSid
RegDeleteValueW
RegOpenKeyExW

kernel32

ReadConsoleW
DecodePointer
LoadLibraryExW
SetWaitableTimer
CreateWaitableTimerW
CopyFileW
DeleteFileW
RemoveDirectoryW
MoveFileExW
GetTimeFormatW
GetDateFormatW
OutputDebugStringW
IsDebuggerPresent
EnterCriticalSection
CloseHandle
LeaveCriticalSection
GetCommandLineW
SetFileAttributesW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentProcess
GetLastError
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
FreeLibrary
SetEndOfFile
FormatMessageW
WideCharToMultiByte
RaiseException
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
GetModuleFileNameW
GetProcAddress
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
SetLastError
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
SetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
EncodePointer
CreateDirectoryW
SizeofResource
WaitForSingleObject
GetSystemDirectoryW
Sleep
LockResource
LoadResource
FindResourceW
GetCurrentDirectoryW
CreateProcessW
GetSystemWindowsDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
GetFullPathNameW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetTempPathW
GetFileAttributesW
OpenProcess
CreateEventW
SetEvent
HeapSetInformation
LocalFree
GetTickCount
GetLocalTime
VirtualLock
WaitForMultipleObjects

ole32

CoCreateGuid

rpcrt4

UuidCreate

ntdll

RtlPcToFileHeader
RtlGetVersion
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
RtlVirtualUnwind
RtlUnwindEx

Sections

.text
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

606a690081d1bdedf2f5dc3cb5f1d4a4

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ole32

rpcrt4

ntdll

Sections

.text Size: 305KB - Virtual size: 304KB

.rdata Size: 144KB - Virtual size: 143KB

.data Size: 6KB - Virtual size: 11KB

.pdata Size: 15KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 305KB - Virtual size: 304KB

.rdata
Size: 144KB - Virtual size: 143KB

.data
Size: 6KB - Virtual size: 11KB

.pdata
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 2KB