0dcfdad1381493700be67ea459b4eb47 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0dcfdad1381493700be67ea459b4eb47
Size

133KB
MD5

0dcfdad1381493700be67ea459b4eb47
SHA1

891217e2373e65c81d60a5d4f003f062ce8e022f
SHA256

51fa8830733a9789fe8268ab1e6042822cbf40ab4fb674a2c77a478e2c0d6c28
SHA512

a2e288a305e21e8166826154fab4c101b95cc9620ea61771a4ea4fd574b567580cac808998a0debd1f8f72ddfd7795e70a81a656351be18ffaf0b57c2e1d243c
SSDEEP

3072:klOWBrdm8tPNTjsEHqWQAFkQoMTMiI5E2DzoVFxoTcNrN2s1:klO2vJjKEFkQoDFLnUFxoQNx51

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dcfdad1381493700be67ea459b4eb47

Files

0dcfdad1381493700be67ea459b4eb47
.exe windows:4 windows x86 arch:x86

df2e663cd6f3899408d79b3e4264d5a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

kernel32

LocalFree
lstrcmpiW
GetCommandLineW
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
CloseHandle
SetFilePointer
CreateFileW
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
LoadLibraryExW
ExpandEnvironmentStringsW
lstrlenW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetTickCount
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
MoveFileExW
GetLastError
EnumResourceNamesW
GetTempPathW
FindFirstFileExW
SetProcessWorkingSetSize
GetCurrentProcess
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
LockResource
LoadResource

shell32

CommandLineToArgvW

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28.1MB - Virtual size: 28.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ