雷神过机器码[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

雷神过机器码.exe
Size

5.1MB
MD5

d6ad614971f4c24a3d7c6977ff45a5c3
SHA1

b363f52f3a3e3772569c3113128eef83a7ce6cd2
SHA256

cdca31be51d09081310e169561c38e7224d68be9b3e1262121c73faaa781e891
SHA512

a2d826db24f591f82a8b97c7168534745c2c9e49ecb6395b2c1852b73371009771d8c4844d2bd85691dcd8473f0354302f3e970e7e9a3a4dadd6f0723333a306
SSDEEP

98304:qTVeJJz8uWfSABDKRZLVel2cTv6PDPMxwY6u9odaS84mj:5Tzgh6dMlx6bA3ad+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
雷神过机器码.exe

Files

雷神过机器码.exe
.exe windows x86

6a42c5c2e884056906d68af3583cf0ec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess

user32

GetForegroundWindow

gdi32

GetTextMetricsA

winmm

midiStreamStop

winspool.drv

ClosePrinter

advapi32

RegOpenKeyExA

shell32

ShellExecuteA

ole32

OleUninitialize

oleaut32

UnRegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

inet_ntoa

comdlg32

GetSaveFileNameA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

Sections

.text
Size: 2.7MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ