tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

1.5MB
MD5

72b72a15ebf9e978839abc947a505b15
SHA1

e9341b4c5f8ca093c1d525fa20c944c939cfe679
SHA256

13cafa582f28ddb9c3893b8731f8129634277d7fb12beb5164d240a94b454259
SHA512

6ba9b0116e160251db0a698d546b584589d4342966807addda33e3bfecc414e03f1ac27bec3bcf0a69e1d4263cd2aed9b06c0be329504c24b144f3508a92b42d
SSDEEP

24576:mEbWmydw4Rj8UEdFMgQmkAuAchFNtrRNjhjPaF+wvJMiaB/PBQn652EOaYiTmclV:v7c7qn3k5HRLjPaY5B38C31l2IU6iG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows x86

3a643a881ba070dc48eb55a444f65fb6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

bcrypt

BCryptGenRandom

advapi32

RegCreateKeyA
CopySid
OpenProcessToken
GetTokenInformation
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
GetLengthSid
SystemFunction036
IsValidSid
LookupAccountSidW

ntdll

NtReadFile
RtlUnwind
NtWriteFile
RtlNtStatusToDosError
NtQuerySystemInformation

kernel32

GetProcAddress
GetTempPathW
TryAcquireSRWLockExclusive
GetEnvironmentVariableW
SetFilePointerEx
SwitchToThread
AcquireSRWLockExclusive
TlsSetValue
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
WaitForSingleObject
DuplicateHandle
GetModuleHandleW
FormatMessageW
ExitProcess
CompareStringOrdinal
TlsGetValue
CreateNamedPipeW
CreateThread
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
SleepEx
ReadFileEx
WriteFileEx
HeapReAlloc
SetHandleInformation
GetProcessHeap
HeapAlloc
AddVectoredExceptionHandler
GetCurrentThreadId
InitializeSListHead
Wow64DisableWow64FsRedirection
IsDebuggerPresent
UnhandledExceptionFilter
CopyFileExW
SetLastError
SetUnhandledExceptionFilter
GetModuleHandleA
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
FindClose
IsProcessorFeaturePresent
TerminateProcess
GetConsoleMode
GetStdHandle
MultiByteToWideChar
WriteConsoleW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateProcessW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFullPathNameW
SetThreadStackGuarantee
GetModuleFileNameW
GetProcessTimes
OpenProcess
GetSystemTimes
GetProcessIoCounters
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetLogicalDrives
ReleaseSRWLockExclusive
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
GlobalMemoryStatusEx
GetTickCount64
DeviceIoControl
GetCurrentProcessId
CreateFileA
WinExec
CloseHandle
GetLastError
GetCurrentProcess
Sleep
HeapFree
CreateFileW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
GetSystemInfo
GetFileAttributesW

ole32

CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitializeEx

iphlpapi

GetIfTable2
FreeMibTable
GetAdaptersAddresses
GetIfEntry2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserGetInfo
NetUserEnum

secur32

LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData

pdh

PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhCloseQuery
PdhOpenQueryA

user32

FindWindowA
SetActiveWindow
SendInput

ws2_32

WSAGetLastError
getaddrinfo
WSASocketW
getsockname
closesocket
ioctlsocket
getpeername
connect
getsockopt
WSAStartup
WSACleanup
listen
setsockopt
recv
accept
select
WSARecv
freeaddrinfo
WSASend
send
bind

psapi

GetModuleFileNameExW
GetPerformanceInfo

oleaut32

VariantClear
SysFreeString
SysAllocString

powrprof

CallNtPowerInformation

api-ms-win-crt-heap-l1-1-0

free
calloc
_set_new_mode
malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initterm_e
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_initterm
abort
_set_app_type
_seh_filter_exe
_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

wcsncmp

Sections

.text
Size: 735KB - Virtual size: 735KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 773KB - Virtual size: 773KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a643a881ba070dc48eb55a444f65fb6

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

ntdll

kernel32

ole32

iphlpapi

netapi32

secur32

pdh

user32

ws2_32

psapi

oleaut32

powrprof

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

Sections

.text Size: 735KB - Virtual size: 735KB

.rdata Size: 773KB - Virtual size: 773KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 735KB - Virtual size: 735KB

.rdata
Size: 773KB - Virtual size: 773KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB