1bf47b938f7efabcb8b83ebbb36dfe9f | Triage

Sharing

General

Target

1bf47b938f7efabcb8b83ebbb36dfe9f
Size

758KB
MD5

1bf47b938f7efabcb8b83ebbb36dfe9f
SHA1

98d78469e44eefcd77b633f9a508dab13acb48c1
SHA256

15aecbac4646e3ab24e31c5ffc7d023f0b972537173b14c2f866bc1fe08ebf1a
SHA512

da1ba3cacbe2c02f5a970f5e190860f1c7abcdb2a0acd3247a0f1fa1bdcb9dcda388319ef6693c7da6a1097af3587fab59c23c66f5c25f31b5eb3af00d9b141f
SSDEEP

12288:oNItM7zihDMg3qCwKmB/qoZg6NjPZdxjv1tVcxhR8pgoNsXg0BL7nr2wdJfpDAe5:BG7q6omRXfNjzFv+WCXg87rVzpO6W2y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bf47b938f7efabcb8b83ebbb36dfe9f

Files

1bf47b938f7efabcb8b83ebbb36dfe9f
.exe windows:4 windows x86 arch:x86

c586b23efc33dfbaf00fad25f7d6bdac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetFileAttributesA
GetModuleHandleA
GetCommandLineA
GetDriveTypeA
SetLastError
GetConsoleTitleA
CloseHandle
GetStartupInfoA
GetCommandLineA
LocalFlags
GetVolumePathNameW
CloseHandle
GetTimeFormatW
GetEnvironmentVariableA
CreateEventW
HeapDestroy
HeapCreate
VirtualQuery
TlsGetValue

advapi32

RegDeleteValueA
IsValidSid
RegEnumKeyA
RegQueryValueW
IsValidAcl
InitializeSid
IsValidSid
IsValidSid
IsValidSid
IsValidSecurityDescriptor
CreateProcessAsUserA
IsValidSid
RegCreateKeyExW

tspkg

SpUserModeInitialize
SpUserModeInitialize
SpUserModeInitialize
SpUserModeInitialize

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 753KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ