af3ecb8dd86f4cc4e30f0070feadf5a7 | Triage

Sharing

General

Target

af3ecb8dd86f4cc4e30f0070feadf5a7
Size

5KB
MD5

af3ecb8dd86f4cc4e30f0070feadf5a7
SHA1

2fd91ef8622a4c8e852a2253815a8141858c043f
SHA256

e5766d6919a5c0129065e70a004af2b40a0219a7971d31e164e4805160cf16da
SHA512

c08ab6d5cfb63ada608ced049898b308d26cf6455e68e84f27885af55dab5386b82fdb1cd42f88163222ff549176e9f014092208b387236bcebb1e57ca5d09c5
SSDEEP

48:i3Aa9uvY6uVg0dJ88RZR4gwrLOP5MYGqJXESlo/ffpMd1Ru1FsWTNQRRhBK0l9hL:Sdr88RtwYMYGqblYnpMBgs1i/cwTg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af3ecb8dd86f4cc4e30f0070feadf5a7

Files

af3ecb8dd86f4cc4e30f0070feadf5a7
.exe windows:5 windows x86 arch:x86

14a2d7b58d3756be5c70b6c15220c9ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugActiveProcessStop
CloseHandle
Sleep
ExitProcess
GetExitCodeProcess
CreateProcessW
VirtualAlloc
DebugActiveProcess
GetModuleFileNameW
lstrcmpiW
lstrcatW
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReadFile
GetFileSizeEx
VirtualFree
CreateFileW

advapi32

RegCreateKeyExW
RegCloseKey
RegSetValueExW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ