fab3bfbc514d2e742f5c1f7d096a1798 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fab3bfbc514d2e742f5c1f7d096a1798
Size

503KB
MD5

fab3bfbc514d2e742f5c1f7d096a1798
SHA1

58d5c34b3fe42810516780cc56604773f90abc64
SHA256

b20605ecbc09ba96f941cbf08c919a119454c7a4033246a4b3365445ea7c606a
SHA512

cc9b09044a45aba9b02844f0a7977ff45673e207e7c55099fb2e02d9d03c7720e3f7329e06d69771f96c183ed6d0c40248f209751be668b9dba060fb72301401
SSDEEP

12288:pUyUdZO+DxasWBE/+77yBHh/+Z/cfFZCIbIzLJoV:pOdZO+DxasWG/nBHh/aIjIuV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fab3bfbc514d2e742f5c1f7d096a1798

Files

fab3bfbc514d2e742f5c1f7d096a1798
.exe windows:5 windows x86 arch:x86

34546ca06d2794f69827a253e03fcdeb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
HeapCreate
DeleteFileA
CreateMutexW
LeaveCriticalSection
SetVolumeLabelA
GetPrivateProfileIntW
SetEnvironmentVariableA
SetStdHandle
GetStringTypeA
LoadLibraryA
SetCurrentDirectoryA
GetCurrentProcess
GetTickCount
GetVolumePathNameW
FoldStringA
GetConsoleTitleA
GetShortPathNameW
lstrcpyA

aaclient

OpenKeyReaderWriter
OpenKeyReader
g_fnStartTransport
LoadClientAdapter

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 1024B - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fdata
Size: 491KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ