0f7df686d75dbece643273d9366701cc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f7df686d75dbece643273d9366701cc
Size

1023KB
MD5

0f7df686d75dbece643273d9366701cc
SHA1

00ce4c300e0ea75c58519f3c14ccafd1020b7e4a
SHA256

07b1e11ff9c218d7be5db1fa6b9e0e94af7b65d070f0012e72b72b6558de39f9
SHA512

14bdd27a788c5325350a715a1dd5535d1929dc4720d585c10962db47fa2ba4f292886d125737694651fdace2a4442d34653e27eb23ce365a3c7d88a649c5b420
SSDEEP

24576:kgYrSNDwGU1jJpxdyONmRLm5BCq1haD1Ng8WSrfNRY:TYrSyP1VBy/Zm3r1wbfHY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f7df686d75dbece643273d9366701cc

Files

0f7df686d75dbece643273d9366701cc
.exe windows:4 windows x86 arch:x86

df2e663cd6f3899408d79b3e4264d5a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

kernel32

LocalFree
lstrcmpiW
GetCommandLineW
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
CloseHandle
SetFilePointer
CreateFileW
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
LoadLibraryExW
ExpandEnvironmentStringsW
lstrlenW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetTickCount
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
MoveFileExW
GetLastError
EnumResourceNamesW
GetTempPathW
FindFirstFileExW
SetProcessWorkingSetSize
GetCurrentProcess
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
LockResource
LoadResource

shell32

CommandLineToArgvW

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ