0365b64d3fa50b0d254c0251f46ec931 | Triage

Sharing

General

Target

0365b64d3fa50b0d254c0251f46ec931
Size

60KB
MD5

0365b64d3fa50b0d254c0251f46ec931
SHA1

df0fe1953efef6614f0f9f3f49f13dd7216ca702
SHA256

728090aded48eb0439e46d525f45a14b99857c65524a76c087193c166e7e71f9
SHA512

f91d78b272041beed30832688d65c4bf9fa072f4127eaf9bfada075a1cf7c984557961535b8df1d8c2d8df0fbebcef76ee64f96ff2ffb378ca860ebdc6156ea3
SSDEEP

768:C+5MRbwWX6+9Ux+Bkj0+h7/oHcuwxOudr2z8:CWMRsx+Bkj0+h7/oHcuwx3f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0365b64d3fa50b0d254c0251f46ec931

Files

0365b64d3fa50b0d254c0251f46ec931
.exe windows:4 windows x86 arch:x86

a8d36a066da80caccc19a05737f85b31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResetEvent
FindClose
SetEvent
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
CloseHandle
CreateProcessA
ReadFile
WriteFile
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcessId
GetCurrentProcess
SetFilePointer
CreateFileA
GetModuleFileNameA
SizeofResource
LoadResource
FindResourceA
lstrcpyA
GetSystemDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
CompareStringA
lstrlenA
GetFileAttributesA

user32

wsprintfA

advapi32

OpenProcessToken
RegCreateKeyA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

SHGetFolderPathA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ