433596d030eea3b52fb49aed6d2f32e1 | Triage

Sharing

General

Target

433596d030eea3b52fb49aed6d2f32e1
Size

770KB
MD5

433596d030eea3b52fb49aed6d2f32e1
SHA1

b1536b5b6848a6c8afb280939ccede6697b7cd0c
SHA256

26b599a7df09f2c81710819f162f3a82e96b1bc5696a4ea4281e8d9ce1bb1533
SHA512

c334003e3e938ec10bc9c35a1dfdfe8d569275ccfa205b82d5e01f3e140927886f29a245befa33b4964b297bfd017ffd90b013d422c67c06d83a3c88aa6615ff
SSDEEP

24576:oxfdX/eqCUAsrN3suLEkLFHWkWElQzBHkIAfPTmf:wfdX/bus5pLdFHWkWE6BEIAfPTM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
433596d030eea3b52fb49aed6d2f32e1

Files

433596d030eea3b52fb49aed6d2f32e1
.exe windows:4 windows x86 arch:x86

5c384e083387cf664e217ee8315d2c31

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
GetTickCount
ReleaseMutex
VirtualQuery
DeleteFileA
GetModuleHandleA
GetCommandLineA
LocalFlags
SuspendThread
CloseHandle
Sleep
GetStartupInfoA
OpenMutexA
SetConsoleCP
GetModuleFileNameW
HeapCreate
lstrlenW
CloseHandle
SetEvent
GetTimeFormatA

advapi32

IsValidSecurityDescriptor
IsValidSid
CreateServiceW
CreateProcessAsUserA
ClearEventLogW
RegEnumKeyA
ControlService
RegCreateKeyExW
RegQueryValueW
InitializeSid
IsTextUnicode
RegDeleteValueA
IsValidAcl

msvcirt

??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 763KB - Virtual size: 763KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ