armadillovka[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

armadillovka.exe
Size

23KB
MD5

519fb9bf6420705eff1f30fbac95f4f7
SHA1

06a34602e2eb2996cc1de86f7b2357d49f5d5997
SHA256

6e080b923d231ee9f697ae1378727564ff240a9e82b2a9410c98300db683902a
SHA512

4aedad4eb3d75cc5df6cf09351bddbb63b665ed72a738d3180e3625ce5bc1868aeffb38339667828b06d9d16b51fb573fe20a490ccbe197924aa8b0c6cdb0e10
SSDEEP

384:2xw7iA6UhlXL/IqUWnOOFAwLcRaT7/hxTRmGndnkIcY:265IaOOFMRa3rYGndnxcY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
armadillovka.exe

Files

armadillovka.exe
.exe windows x86

b255ef688702649f36b6fbbdd46626ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

CreateProcessA
CreateToolhelp32Snapshot
ExitProcess
FreeLibrary
GetProcAddress
GetThreadContext
GlobalAlloc
LoadLibraryA
OpenThread
Process32First
Process32Next
ReadProcessMemory
ResumeThread
RtlZeroMemory
CloseHandle
Sleep
SuspendThread
TerminateProcess
Thread32First
Thread32Next
VirtualAlloc
VirtualProtectEx
WriteProcessMemory
lstrcatA
CreateFileA
GetFileSize
ReadFile
FlushFileBuffers
WriteFile
SetThreadContext

comdlg32

GetSaveFileNameA
GetOpenFileNameA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE