043bfe2f09e73855aeb94fc5ea4b8c35 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

043bfe2f09e73855aeb94fc5ea4b8c35
Size

9KB
MD5

043bfe2f09e73855aeb94fc5ea4b8c35
SHA1

f5a6608e41d6c0cc8b89006f71dde34daea2bec8
SHA256

e4ee45a4b0c2fc56405aa63051920b1f4093c151ad1939aa13154e177732d1f4
SHA512

529ee2d7ee321a5873be3fc2acaadcc64672c253761f0c47017746fc2e93fd5a451a94934ecd57f4f352ac934eafc65facdca035e889d36d5028025d1ffa2174
SSDEEP

96:ujEwdQM07FjF+ExBsYOJ1gt8eyx5thRmMc4uXWmJcTbZX3cMDNCkBOo4R:ME8Ql9F+ystOWu1cZ3cMDNCkBP4R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
043bfe2f09e73855aeb94fc5ea4b8c35

Files

043bfe2f09e73855aeb94fc5ea4b8c35
.exe windows:4 windows x86 arch:x86

2aec751b0a7fb9e246233e392651fffa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

CreateProcessA
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetFileSize
GetTempPathA
LoadResource
MapViewOfFile
ReadFile
ReadProcessMemory
ResumeThread
RtlMoveMemory
SetEnvironmentVariableA
SizeofResource
Sleep
CreateFileMappingA
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
WinExec
WriteProcessMemory
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
FindClose
FindFirstFileA
FlushFileBuffers
WriteFile
GetModuleFileNameA
GetModuleHandleA
SetCurrentDirectoryA
CreateFileA
CloseHandle
TerminateProcess

advapi32

RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ