1d0fe0bdd9c9e52edeba219a668b63d1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1d0fe0bdd9c9e52edeba219a668b63d1
Size

382KB
MD5

1d0fe0bdd9c9e52edeba219a668b63d1
SHA1

33d16a395e13650d98167fac5c6c7c6f5c94439f
SHA256

7d276f66bd80c7a585c584fbd59d4be958fc01a7cbedb5e78aa85ac75f75c274
SHA512

fc186515431f254a3d68b5bbf3dec40d18c96d086e9effc622ccb5ee0512747add5260c20448c78747320087ec284a5c477a2650d0bec93ed295c7e6cfc1c0df
SSDEEP

6144:RwRMOlVI8mJ+ehSemWfSZSzuhgrE9dYCb8xf4I7GVltNyEe6EofQKKfnGIYt3yKN:qRMOlVI8mJlmWp6hgricAQG3Xxai5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d0fe0bdd9c9e52edeba219a668b63d1

Files

1d0fe0bdd9c9e52edeba219a668b63d1
.exe windows:4 windows x86 arch:x86

c7c783c8fdb9730e0aef06f86e2cb38c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
GetStdHandle
LocalFree
GlobalFree
VirtualAlloc
GetEnvironmentVariableW
CreateMutexA
InterlockedExchange
GetModuleHandleW
GetCommandLineA
ResetEvent
GlobalSize
lstrlenA
FindVolumeClose
GetACP
CreateEventA
GetPrivateProfileIntW
CloseHandle
ResumeThread
WriteFile

advapi32

ControlService
RegCloseKey
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
ClearEventLogW
CreateServiceA
RegDeleteValueA
IsTextUnicode
CloseEventLog
IsValidSecurityDescriptor
IsValidSid
RegDeleteKeyA

asycfilt

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

hdwwiz.cpl

InstallNewDevice

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ