tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

407KB
MD5

da136ac5b3f17c7aad353c7a5eb2c005
SHA1

e4fa899c7a5962c8f0a83ae2b0fecf70ed68f8b3
SHA256

b620bc05a78d5e1b47b281f97124c622a38fd61b50d3af8f9274377e5c3f7558
SHA512

8cb161accad6c78386208fd2c48b87fafc9f220d123237ac572f6568e0e0724de9b2dc7117731e48a8d06d58e8734982c47c4c48fbe82919d52a9e85838f80eb
SSDEEP

6144:+tTdkqymONVM/txL4UZeENBVOrFiIax5WY+EJxE5vXK5aS:sdkqymsM/DL7ZesOS0PEg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:5 windows x64

0ee26c64077262ad1196164faba874b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
RegisterClassExA
ExitWindowsEx
BlockInput
SystemParametersInfoA
wsprintfA
MessageBoxA

kernel32

Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
SetThreadExecutionState
GetLastError
CreateMutexA
SetConsoleCtrlHandler
GetCurrentProcess
DeleteFileA
GetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
CreateThread
LocalFree
CreateNamedPipeA
WriteFile
ReadFile
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
CreateFileA
RtlVirtualUnwind
GetLocaleInfoA
EnterCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetModuleHandleW
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
RaiseException
RtlPcToFileHeader
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwindEx
DeleteCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
InitializeCriticalSectionAndSpinCount
HeapSetInformation
HeapCreate
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapReAlloc
GetStringTypeA
GetStringTypeW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ee26c64077262ad1196164faba874b8

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

Sections

.text Size: 238KB - Virtual size: 238KB

.rdata Size: 95KB - Virtual size: 94KB

.data Size: 62KB - Virtual size: 100KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 432B

.text
Size: 238KB - Virtual size: 238KB

.rdata
Size: 95KB - Virtual size: 94KB

.data
Size: 62KB - Virtual size: 100KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 432B