2bafb7c0f487037138b779e1911f472e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2bafb7c0f487037138b779e1911f472e
Size

30KB
MD5

2bafb7c0f487037138b779e1911f472e
SHA1

24856a4d83c03174960f74b2034dcbfe98808722
SHA256

d0ae96c250dc40d710c01df7a2f97d95c5b01fea0c92e37c2ae69c112c1fcece
SHA512

b1ca60449d55e4254a06a66305f7617030a44d586343799f8160fe39737062d3ab98ed949ca5d2a183e6cd30d89c6458278f13615c357bd74c9917f994d33238
SSDEEP

768:8k5etqJFFtyXjgbH7E9h6wPehsWgdPsKx0Ofn+Lr3vfVq:NemFn/46ZhAUKx0Of+/vf4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bafb7c0f487037138b779e1911f472e

Files

2bafb7c0f487037138b779e1911f472e
.exe windows:4 windows x64 arch:x64

27516fd8750f40bdecf52a1420a0296a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

strlen
malloc
memset
getenv
sprintf
printf
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

kernel32

Sleep
GetModuleFileNameA
CreateProcessA
CloseHandle
SetUnhandledExceptionFilter

ntdll

NtAllocateVirtualMemory
NtWriteVirtualMemory
NtCreateThreadEx

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ