ADNotificationManager_dump[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ADNotificationManager_dump.exe
Size

60KB
MD5

8b9c9e0a34b9e72db5af481423e01c7f
SHA1

104271f4225794245452836d11fdb877fffbe27e
SHA256

7272b1b7c99fd7f5d490554146c702c754777a0b9b835c5bfdae6879f2d65245
SHA512

0b9ffd48842677fe2848680e4022dbee79025b711a025e30e47c2215019f88864087eab1a592f55035c60059c5ef94611cd14ee52d966ee8e64a7821be7700b7
SSDEEP

768:Z45O9Z4yqc7ycXrYCeiILW71TZ4G2Ql3T97pyKS/UP5/MgQKFZapTbeEuFOqC:i5O9Z4yq61r+L21TZ32Q3t/MbKUeE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ADNotificationManager_dump.exe

Files

ADNotificationManager_dump.exe
.exe windows x86

cd54843d3fee4a0e6a727c5c5e30b1cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetCurrentProcess
GetFileAttributesW
OpenProcess
CloseHandle
GetModuleFileNameW
Sleep
WaitForMultipleObjects
HeapAlloc
CreateMutexA
GetLastError
CreateThread
DeleteCriticalSection
VirtualAlloc
MultiByteToWideChar
IsDBCSLeadByte
WideCharToMultiByte
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
HeapFree
InitializeCriticalSectionAndSpinCount
DeleteFileW

user32

ReleaseDC
GetDC

gdi32

GetObjectW
GetCurrentObject
DeleteObject

crypt32

CryptProtectData

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ