af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b | Triage

Sharing

General

Target

af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b
Size

283KB
MD5

463a1260b1660f53064ef7ef13f7ea83
SHA1

c933d607f121d111a4f10d90e08b397e4b6ee734
SHA256

af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b
SHA512

33ca39429012588f27b7882316c29873ad9430d366a19cf73f96e124834cfbcf722ac4f7bbf8a54dfb74b1081d8abd907c49a2c9eeece83a713dfd887bae81d3
SSDEEP

6144:RImP78oPMFXltEAYI/x+R9RmZO19iEBThpYk:XPQoPMF8CMp2y9iCTbY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b

Files

af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b
.exe windows:6 windows x64 arch:x64

3d038da58dcc03d761a851caf1420778

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CopyFileA
CreateFileA
CreateFileMappingA
CreateProcessA
ExitProcess
FindResourceW
FreeLibrary
FreeResource
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetTempPathA
GetTickCount
GlobalMemoryStatusEx
HeapAlloc
HeapFree
IsBadReadPtr
LoadLibraryA
LoadResource
LockResource
SizeofResource
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WinExec
WriteFile
lstrlenA

user32

MessageBoxA
wsprintfA

api-ms-win-crt-string-l1-1-0

strlen

Exports

Exports

_memicmp

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ