tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

3.9MB
MD5

94b8145a8ae4ef701b8e34c382209b16
SHA1

b4813f35d0c8049f9c68cacb5bdd003df1030942
SHA256

dc25da4a45453cb00056963251d9655ef79b4ea38229f4bfeb339c18ad75f02e
SHA512

6da6466a55c5bf0a679c7137081171c1d222f2802ebef4e57ec72b46e381ad72184e9c07d77414ef8046bf21ab3fe63334db82121fd223173b2478e2bc6c8f38
SSDEEP

98304:cNOsDVDhiXQMeKweELtiUkWvncWmnNFyloO6VZd3dRO3:cNOsDVDhLMeteTG9mCOO6VzO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:6 windows x64 arch:x64

a63eb14badbc986df5a60516fe5a20b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtDeviceIoControlFile

oleaut32

SafeArrayDestroy

kernel32

GetStdHandle
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

ws2_32

socket

crypt32

CertFreeCertificateChain

advapi32

RegQueryValueExW

user32

GetMonitorInfoW

bcrypt

BCryptCloseAlgorithmProvider

secur32

InitializeSecurityContextW

gdi32

CreateCompatibleBitmap

ole32

CoInitializeSecurity

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-math-l1-1-0

log

api-ms-win-crt-heap-l1-1-0

_msize

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.9Xz
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.%Dg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nLw
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a63eb14badbc986df5a60516fe5a20b7

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

oleaut32

kernel32

ws2_32

crypt32

advapi32

user32

bcrypt

secur32

gdi32

ole32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 3.0MB

.rdata Size: - Virtual size: 1.1MB

.data Size: - Virtual size: 27KB

.pdata Size: - Virtual size: 70KB

_RDATA Size: - Virtual size: 348B

.9Xz Size: - Virtual size: 1.3MB

.%Dg Size: 4KB - Virtual size: 4KB

.nLw Size: 3.8MB - Virtual size: 3.8MB

.text
Size: - Virtual size: 3.0MB

.rdata
Size: - Virtual size: 1.1MB

.data
Size: - Virtual size: 27KB

.pdata
Size: - Virtual size: 70KB

_RDATA
Size: - Virtual size: 348B

.9Xz
Size: - Virtual size: 1.3MB

.%Dg
Size: 4KB - Virtual size: 4KB

.nLw
Size: 3.8MB - Virtual size: 3.8MB