3f1e94b211834574f839721e6a577e18 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f1e94b211834574f839721e6a577e18
Size

322KB
MD5

3f1e94b211834574f839721e6a577e18
SHA1

77d0038c10a9d6f577c44bcfb0569d70be1918c7
SHA256

77fcf2455dddf5c10a73dc2ab8a6cf1b38ec991817410bc3bfe36704e05f8698
SHA512

d65d5503b1d709242f18ad4c76b9a0bc52ef8b253e4f5b047439a19557388ea285df794f7a817dc97dae0db37b2c5eb761bb85a5b35316d8cf39da480a65e867
SSDEEP

6144:MLYvWQc2Ca+3zswx78NDjJvqODWUgBJxCCnCp5JRNAAg3moJNO0q26zKe0o2jFc:lOQaN78FWUgXk/pfRu1o0p6zKe32jF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f1e94b211834574f839721e6a577e18

Files

3f1e94b211834574f839721e6a577e18
.exe windows:5 windows x86 arch:x86

9458817539edc50a5e54b3ab02215444

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

_itoa
NtAllocateVirtualMemory
NtAdjustPrivilegesToken

rpcrt4

CStdStubBuffer_DebugServerRelease
NdrOleFree
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
NdrOleAllocate
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrDllGetClassObject
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow

Sections

.text
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE