72cdf03ea4ba6a1888b60945731ccded | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72cdf03ea4ba6a1888b60945731ccded
Size

812KB
MD5

72cdf03ea4ba6a1888b60945731ccded
SHA1

d500cf7fa37a86dd0306163677a364d984170080
SHA256

603dccd92efc6757fb57afe843e8a86cbd7af8d5343eca0fc5a9251d20e8d240
SHA512

1222bfc8844edb8133f78027c549ef8fbdddbd25eb55fc32b8c6a243b3396049ad0ff70ed796840b8c73d6e33e0657df7769828f280c30c47dfb7771c3855f98
SSDEEP

24576:nmzMUG5crCdOot43YCbWQk7kkJZtIaVpK+LErX:n1UmdcR8FJcae+LE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72cdf03ea4ba6a1888b60945731ccded

Files

72cdf03ea4ba6a1888b60945731ccded
.exe windows:5 windows x86 arch:x86

b3a4de1098a4fb26c9c8d291cca8249f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumePathNameW
GetConsoleTitleA
LoadLibraryA
SetStdHandle
SetCurrentDirectoryA
GetStringTypeA
EnterCriticalSection
DeleteFileA
LeaveCriticalSection
GetCurrentProcess
SetEnvironmentVariableA
lstrcpyA
CreateMutexW
SetVolumeLabelA
GetPrivateProfileIntW
GetTickCount
FoldStringA
HeapCreate
GetShortPathNameW

aaclient

g_fnStartTransport
OpenKeyReaderWriter
OpenKeyReader
LoadClientAdapter

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 1024B - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fdata
Size: 801KB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ