f_0013ec[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f_0013ec.exe
Size

27KB
MD5

9a3f1ee6d52fa6bf077da9209c237c87
SHA1

905a19355bd9d41277851809063a905d71229881
SHA256

877a0ea1e813b813804f67f4f1b805ffc9efc4b1fd41d969960edf6301fcff7c
SHA512

f953f1f0a868ef0f78c1761bd7e5e353842ae55f0bbfeaa2854a330be2442e9f12f48b51a715b50935cf79d01f4550f0cb12dfb7b92d4ba5e38092cd4cc1444d
SSDEEP

768:BlBzHxrehKbswK2TchDLQZfVBdaaWuW6CM+Lx0:59rJsL2TchvQZfzdTV+V0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f_0013ec.exe

Files

f_0013ec.exe
.dll windows:4 windows x86

cd53277eaa7bbb8fb5b2b678274dcb4e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateProcessA
SearchPathA
CloseHandle
CreateFileA
lstrcpynA
lstrcatA
FindFirstFileA
FindClose
lstrlenA
lstrcmpiA
lstrcpyA
GlobalFree
GlobalAlloc
WriteFile

user32

SendMessageA
FindWindowExA
GetDlgItem
wsprintfA
CharUpperA

advapi32

RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Exports

Exports

_Close
_CopyKey
_CopyValue
_CreateKey
_DeleteKey
_DeleteKeyEmpty
_DeleteValue
_Find
_HexToStr
_KeyExists
_MoveKey
_MoveValue
_Open
_Read
_ReadExtra
_RestoreKey
_SaveKey
_StrToHex
_Unload
_Write
_WriteExtra

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ