13fc3a0226a20cc78daaaca711776dc8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

13fc3a0226a20cc78daaaca711776dc8
Size

60KB
MD5

13fc3a0226a20cc78daaaca711776dc8
SHA1

d297a21483136c79708a54581cfcef6da088aea1
SHA256

09e8af7424a6015c7279e80b8bcbb841f77b19c7f77220eb088d4c909e7821ae
SHA512

3d523ffd5dc8addbe908d93ec02d9efbbb697432aec823d1e2a59b627c1be48d4b33f337d3448ee1cae10d82f24fea380efc834b02dbbc070eb342d647411d83
SSDEEP

768:Y6kZzohqL3TdoXHMsHxPnLPxrQPcHVMbaspQfW1vCnzojy0gVr8d4q:Y6kZzd3Tdo3MsRPTac1DIQ2qnz2yhRd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13fc3a0226a20cc78daaaca711776dc8

Files

13fc3a0226a20cc78daaaca711776dc8
.exe windows:4 windows x86 arch:x86

1e1d46e3bf6a210f761f54a7abb04fc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetTickCount
GetLastError
lstrlenA

user32

wsprintfA

advapi32

OpenServiceA

ntdll

strncpy
memset
memcpy
strlen
strcpy
strcmp
_allmul
wcscmp
wcscpy
wcslen
strstr
RtlUnwind
NtQueryVirtualMemory

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE