2ecaa4a4541645f3d329b65981f97403c3a3cc2bf77feeecef4cc5108e5eb649 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ecaa4a4541645f3d329b65981f97403c3a3cc2bf77feeecef4cc5108e5eb649
Size

120KB
MD5

c58ae4f7d153e4d5d14a0996b9935fbc
SHA1

19cfa08719d43127efad5f69aace5e57d4d537ae
SHA256

2ecaa4a4541645f3d329b65981f97403c3a3cc2bf77feeecef4cc5108e5eb649
SHA512

6f97c192f2fee47986fee82629c8fdf1aa2fab9558267710893dec90df53db81e89e6daf649b4ce41ec5bff632c25df8e3d4e3459fb1b4ce12d2f57d95e21571
SSDEEP

3072:t7aSAIV9akBThPFu6wJnpo33ebEvTHM4O:t4kaiFkJnpjbEjM4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ecaa4a4541645f3d329b65981f97403c3a3cc2bf77feeecef4cc5108e5eb649

Files

2ecaa4a4541645f3d329b65981f97403c3a3cc2bf77feeecef4cc5108e5eb649
.exe windows:5 windows x86

2c1c2984abb335f6eca5b0f9cdb759c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
UpdateResourceW
GetProcAddress
lstrcat
lstrcpyA
GetFileSize
AllocConsole
LoadLibraryW
CreateFileA
GetModuleHandleA
CopyFileExA
LoadLibraryExW
OpenEventA
CreateMutexW
GetOEMCP

authz

AuthzInitializeContextFromSid
AuthzFreeContext
AuthzAddSidsToContext
AuthzFreeResourceManager
AuthzFreeAuditEvent

shell32

SHFileOperationW
SHFree
SHGetDesktopFolder
ShellAboutW
SHGetFolderPathA
DragQueryFileA
DllRegisterServer
StrStrA
SHGetDataFromIDListW
ShellMessageBoxW
ShellExecuteW

cfgmgr32

CM_Add_Empty_Log_Conf
CM_Add_Range
CMP_Report_LogOn

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

jdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

jdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_MEM_READ