045ffb11553bd92fcfcf496b0ddd9186 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

045ffb11553bd92fcfcf496b0ddd9186
Size

382KB
MD5

045ffb11553bd92fcfcf496b0ddd9186
SHA1

2912b1b46a4e474fd28045161adbb2a8f0454b94
SHA256

5ae8f796b9eab74ee5da3c6789dd0d53e50d14e46761e5ac742d6ef030702a3f
SHA512

85347f934df432ec05b03d2f8b28dd43940df935b5b7d3fed78ef550cddb65bccffa1b8e94ce77e83d6a9d8f5f032efd819125bf5af06288fef392bd0f45e5cf
SSDEEP

6144:FZbe3ZRM1I8mJ+ehSemWfSZSzuhgrE9dYCb8xf4I7GVltNyEe6EofQKKfnGIYt3L:/GZRM1I8mJlmWp6hgricAQG3Xxai5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
045ffb11553bd92fcfcf496b0ddd9186

Files

045ffb11553bd92fcfcf496b0ddd9186
.exe windows:4 windows x86 arch:x86

e75263a13cac4e956b7ff156b9781407

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntW
GetEnvironmentVariableW
ResumeThread
VirtualAlloc
GetCommandLineA
InterlockedExchange
LocalFree
GlobalSize
lstrlenA
GetExitCodeProcess
GlobalFree
GetACP
GetModuleHandleW
GetStdHandle
ResetEvent
WriteFile
FindVolumeClose
CreateMutexA
CreateEventA
CloseHandle

advapi32

IsValidSecurityDescriptor
ClearEventLogW
RegCreateKeyExW
CreateServiceA
IsValidSid
CloseEventLog
ControlService
RegQueryValueW
IsTextUnicode
RegEnumKeyW
RegDeleteValueA
RegCloseKey
RegDeleteKeyA

asycfilt

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

hdwwiz.cpl

InstallNewDevice

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ