17a130de336da65d8dc240c5e9bca90b | Triage

Sharing

General

Target

17a130de336da65d8dc240c5e9bca90b
Size

14KB
MD5

17a130de336da65d8dc240c5e9bca90b
SHA1

518434ff43116789062973ea8faec0f2cff3c48f
SHA256

cf2ca2ca387f00f16768671dc58856f6940217bd2c43d783e5eadb98648818ee
SHA512

8904498f58968bd88bb2c68d238c4888bf7f0124316ba4d135f3319c8b54d9ed66efc15f973671aa7fab9523bf514eeffd35cbfa243a54dd4c8ceb8523130acd
SSDEEP

192:H0RoaKpCN1CxphMGqPFY68UrJBF1buUAVNO9RUCpkr6UcgvXt6M6/v:H0yaKCN0bMrbrqmErxcgvXt6MSv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17a130de336da65d8dc240c5e9bca90b

Files

17a130de336da65d8dc240c5e9bca90b
.exe windows:4 windows x86 arch:x86

4dc2eabbe7e69f3314a48d07cde84db8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedExchange
VirtualQuery
GetModuleFileNameA
OpenEventA
SetEvent
Sleep
DeleteFileA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
RtlUnwind
CloseHandle
HeapReAlloc
ExitProcess
GetModuleHandleA
GetCommandLineA
OpenProcess
GetShortPathNameA
GetEnvironmentVariableA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
lstrcpyA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
HeapFree
HeapAlloc
VirtualAlloc

user32

MessageBoxA
ExitWindowsEx
wsprintfA
CharUpperA

advapi32

RegEnumKeyA
RegSetValueExA
RegQueryValueExA
OpenProcessToken
RegCreateKeyExA
RegOpenKeyA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
LookupPrivilegeValueA
RegDeleteValueA

shell32

ShellExecuteExA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE