3de9c561560d81e41e679c0b29b84880 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3de9c561560d81e41e679c0b29b84880
Size

167KB
MD5

3de9c561560d81e41e679c0b29b84880
SHA1

df03d291c050c24ab233fa4cddadd59fa5d51ae6
SHA256

71a0ddab0ffdd9e36834fc78995f31ce9aa72c63c00cdd7318b4d0cf7cc40074
SHA512

88d56931657f7538c8316b2d740ceb27dd71d4bdfe0f1127110353200b51a04b2f8e49e521f030a2a77993c99d77a55cdcfc51621f2c6cd496f7e3dd48f905a3
SSDEEP

192:MdMHzeWwbnjvuGSvkGm0TvEqyvYUzWSwZzl6:MRbnjvuGSvkGbTvEqyBzNwVY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3de9c561560d81e41e679c0b29b84880

Files

3de9c561560d81e41e679c0b29b84880
.exe windows:4 windows x86 arch:x86

8a5891b6176a4065c17f5405c7e82fa9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

kernel32

AddAtomA
CreateEventA
ExitProcess
FindAtomA
FreeLibrary
GetAtomNameA
GetLastError
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
WaitForSingleObject

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
signal
system

user32

SetWindowsHookExA
UnhookWindowsHookEx

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 272B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE