169a130dec443359e9007ad0334b6793 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

169a130dec443359e9007ad0334b6793
Size

22KB
MD5

169a130dec443359e9007ad0334b6793
SHA1

02a959b286f0b508b789fd979de0eec06161d56c
SHA256

c187a5e575677b148e509065815df45cc577efeb68d000764c8b941b3962741a
SHA512

120fa41271ca1642b2a8e4010f76fa046aa17066ff32eff76b72553047bb5e992f5516e5cc6988f1f4bd9f08acac44b2b20ffef45435da72bff19e186686d696
SSDEEP

384:2EuNVFS0v+h/QM8hQxRiESKtTELEEDcF+pwfYOhDX9zoHWfO:wPPvKpYmiEmE1VPhDRRW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
169a130dec443359e9007ad0334b6793

Files

169a130dec443359e9007ad0334b6793
.exe windows:4 windows x86 arch:x86

ff3357c629adaa00f6f0d86be23f113e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
GetFileTime
CopyFileA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetModuleHandleA
GetProcessHeap
ResumeThread
GetPriorityClass
OpenProcess
VirtualAlloc
VirtualFree
GetCurrentProcessId
SetLastError
CreateRemoteThread
GetProcAddress
FreeLibrary
GetVersionExA
GlobalMemoryStatus
CloseHandle

user32

CharLowerA

advapi32

OpenProcessToken
LookupPrivilegeValueA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE