0faf8041fc0fdf56bbeef361d9b14eb2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0faf8041fc0fdf56bbeef361d9b14eb2
Size

64KB
MD5

0faf8041fc0fdf56bbeef361d9b14eb2
SHA1

5fb95f3552d1302599f2eebe5d61a53fd8588cf0
SHA256

46d2803b9a9e6ad1c67559aa75a67dd01e5a245c66915f8deb8248d05e7bca1b
SHA512

32ddc09f7f5c7a386612f080a406f9a1408cf863cfc55dd42e6ff30c3764d70c3fba3c129a47186278064d6aed6664a6c706f9167599a1fcc91ddab91cac72a6
SSDEEP

1536:SqMpJc+8JhXlR9ceq3U6rl4OHl9pti1XE:SbJdMhXtr6rl4OHDDiK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0faf8041fc0fdf56bbeef361d9b14eb2

Files

0faf8041fc0fdf56bbeef361d9b14eb2
.exe windows:4 windows x86 arch:x86

64bc9219a31e011ab17d7969582ff6bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
LoadResource
SizeofResource
FindResourceA
CreateMutexA
OpenMutexA
LockResource
CloseHandle
GetStartupInfoA

advapi32

GetUserNameA

msvcrt

strcmp
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ