f398064704[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f398064704.exe
Size

2.6MB
MD5

2a32e48097aae61e8f9d9fdd01056c76
SHA1

dc107a532c482e0889c892a840872e7483f598b8
SHA256

fea885fc4f864c23889c056d5d5a2ab620fce890922301307bb5d5c3dd439af9
SHA512

d560a8a7fd6c7f19376d2734819725499d5ff705c80a05e292763846b95130ef590617357679710f7073e0ae69642416afa4b189db956beef44b47a98792158c
SSDEEP

49152:QxI2PJs/nVuNeErpfx7GuG5uXduoP9XwQcmzIvmLs1uVDDhln:QpR4noNe2TquiMu0cMs1cln

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f398064704.exe

Files

f398064704.exe
.exe windows:6 windows x86 arch:x86

c70d093e5ae61cee28c583019923f00f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

EnumDisplayDevicesA

advapi32

GetCurrentHwProfileW

gdi32

BitBlt

shlwapi

PathFileExistsW

winhttp

WinHttpCloseHandle

iphlpapi

GetAdaptersInfo

wininet

HttpAddRequestHeadersA

crypt32

CryptStringToBinaryA

Sections

.text
Size: - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msi%0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.msi%1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msi%2
Size: 2.5MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 135KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ