AAAd1[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

AAAd1.exe
Size

196KB
MD5

94f7dacd5b046eba244fceebe7b9a1dd
SHA1

02db8d219f8b97fc25d812e9c0012e6ffb3e71e1
SHA256

a5476eed216a55fa35d1a0ed0b4be51ce8c376e12a44a8f74f1ee9b1e0a1e685
SHA512

0364a6f74fb7e1632d540c30478f8e5f60c014de2a7282ec128fe5c00deb93d6d054a4519c089292aa72b0fe90b89579b6236a26223586a795beff0a0252594b
SSDEEP

3072:uaY0LwJqqkCPyIrxC55W86GOsKc9P5bivyKKT9cWCeGW801Io:u7VvxJGFrP5+vUOEf1Io

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AAAd1.exe

Files

AAAd1.exe
.exe windows x86

a19128c77d60d2b394dfa78b2e70b342

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord217
ord173

credui

CredUIParseUserNameW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

SetStdHandle
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
WriteConsoleA
GetConsoleCP
SetFilePointer
RtlUnwind
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleOutputCP
GetCommandLineW
SetEnvironmentVariableW
GetCurrentProcess
GetProcAddress
Sleep
CloseHandle
GetLastError
CreateProcessW
GetShortPathNameW
GetModuleFileNameW
SearchPathW
GetComputerNameW
FormatMessageW
LoadLibraryW
LocalAlloc
LocalFree
GetModuleHandleW
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers
GetConsoleMode
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
WideCharToMultiByte
LCMapStringA
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
MultiByteToWideChar

user32

CreateDialogParamW
DialogBoxIndirectParamW
InflateRect
GetSysColorBrush
SetCursor
DispatchMessageW
MessageBoxW
EnumWindows
SetDlgItemTextW
GetMessageW
TranslateMessage
PostQuitMessage
ChildWindowFromPoint
IsDialogMessageW
GetSysColor
RegisterClassExW
ShowWindow
LoadIconW
DefWindowProcW
InvalidateRect
SetWindowTextW
GetWindowThreadProcessId
SendMessageW
GetDlgItem
LoadCursorW
EndDialog

gdi32

SelectObject
GetStockObject
GetObjectW
SetTextColor
CreateFontIndirectW
StartPage
GetDeviceCaps
EndDoc
EndPage
StartDocW
SetMapMode
SetBkMode

comdlg32

PrintDlgW

advapi32

RegSetValueW
CreateProcessWithLogonW
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetMalloc
SHGetDesktopFolder

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 104KB - Virtual size: 100KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a19128c77d60d2b394dfa78b2e70b342

Headers

File Characteristics

Imports

msi

credui

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 8KB - Virtual size: 6KB

Size: 104KB - Virtual size: 100KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 8KB - Virtual size: 6KB