tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

364KB
MD5

c3017eaf630350cf74506e6c3f8bd35c
SHA1

3936e086c92ab57d41e0754504f633a0290c33de
SHA256

8f7eb3b62ed2592a723c94fa0a0fa2e0303c4352e980879dbe83d4ff6cfb73c8
SHA512

99d0ac2dfcb84a5419b1d096b53257f1f29558ca236cdacb48f77c15dafbcbbc8cb5b27fedf0fd57722eb1cb38b6e8460954db5ccc9dd41f6be00ac387f4798f
SSDEEP

6144:/WQCqks6e/Jt1mLue1ocfn/60OJ9zF94+ObZl6E+W1p4ujfhtr:/WQpkycLue1ocf/XOTzHOKErl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:5 windows x64 arch:x64

26be15245910d74758aa31681e690852

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
RegisterClassExA
ExitWindowsEx
BlockInput
SystemParametersInfoA
wsprintfA
MessageBoxA

kernel32

FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetVersionExA
DeleteFileA
GetCurrentDirectoryA
CreateFileA
GetModuleFileNameA
GetModuleHandleA
SetConsoleCtrlHandler
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
Sleep
GetFullPathNameA
CreateThread
LocalFree
CreateNamedPipeA
WriteFile
ReadFile
CreateMutexA
GetLastError
SetThreadExecutionState
SetEndOfFile
GetProcessHeap
ReadConsoleInputA
SetConsoleMode
CloseHandle
FlsSetValue
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
RaiseException
RtlPcToFileHeader
EncodePointer
DecodePointer
FlsGetValue
GetFileAttributesA
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSize
RtlUnwindEx
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DeleteCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapSetInformation
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

advapi32

RegSetValueExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
RegQueryValueExA

shell32

ShellExecuteA

Sections

.text
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26be15245910d74758aa31681e690852

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

Sections

.text Size: 286KB - Virtual size: 285KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 9KB - Virtual size: 58KB

.pdata Size: 14KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 432B

.text
Size: 286KB - Virtual size: 285KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 9KB - Virtual size: 58KB

.pdata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 432B