demo[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

demo.exe
Size

266KB
MD5

b204bee0440f1d7b82c64107610ea9b5
SHA1

19e90aa3148486c11b09d8c2a53d422cfb64666a
SHA256

4fe0567deaebf80940256156e61603749d94be838dfa7e163be8922bd3a4b3b4
SHA512

43ebec54f470b97ba14f1e8653444274a460e2965af6ad83866f459ad6c4846a1070b90e3623fe0c97818dfab8ca2ba9f8a13bbda85c3d1d26f3901debc61ba8
SSDEEP

3072:GLtkcR/5ks/ttjJDCzFII5ar3Cbs5Um4rqrTHqDFT:8XbjCFIIMSw5UpkaF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
demo.exe

Files

demo.exe
.exe windows:4 windows x86 arch:x86

720c886028db8a7751d3b002098f0b27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

urlmon

UrlMkGetSessionOption

shell32

SHGetSpecialFolderLocation

wsock32

WSACleanup

ntdll

NtQueryInformationProcess

rpcrt4

UuidCreateSequential

Sections

CODE
Size: 118KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE