tmp | Triage

Sharing

General

Target

tmp
Size

7KB
MD5

dffa738e21daf5b195cda9a173d885fc
SHA1

441cb819e9ef15ece841b8776c1e6eec1e68ec95
SHA256

fc7f4a32ad5d939024f941c04f123edc4e4e51d4974313e001130a2e466119a2
SHA512

03859b0909203a5aef273cb568404e9c78549328783d7988aebacb18fc5fc5647aab87939783df03eab75625919665560b6b17f744d5809a7e1262fb63b8c5ad
SSDEEP

96:S5bbVm8uw0GSYUKRYHQb+cM8b4PtboynuYUL8PCtbOoX:4fVm8yP0b48sP1oynfUL8ebJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows x86

d65758d31215fa0cf1abf175e24d35cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

msvcrt

__p__fmode
__set_app_type
__p__commode
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
srand
rand
memset
_except_handler3

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetOpenUrlW
InternetOpenW
InternetReadFile

urlmon

URLDownloadToFileW

kernel32

MoveFileW
ExpandEnvironmentStringsW
CreateProcessW
Sleep
MoveFileA
DeleteFileA
DeleteFileW
GetTickCount
GetModuleHandleA
GetStartupInfoA
WriteFile
CreateFileW
CloseHandle

user32

wsprintfW

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ