003969b45029bb1cb45c51d4cd3f3d24 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

003969b45029bb1cb45c51d4cd3f3d24
Size

380KB
MD5

003969b45029bb1cb45c51d4cd3f3d24
SHA1

7c5d4f6afe7091122cf38e873c81d4c4d5e9f3ac
SHA256

8df758ca3faa680380665d55016bc2102f204db72b0b1a26cb377512ce74fba4
SHA512

83297d8a14a0b0f742ab018ccc4b6880ec6bbe35a2da5e4b41b52e92094236905763e497a44e5c9f80321dff137be62aba1e9525991dafc9486118c296a6f492
SSDEEP

6144:hecARM6iWjhtgYXL7TO6dHyF6EDWVUlMVcZOV6fGhmLjAR73t3ygCkv:hIRMklbq6Vxh8MV9VOpO73tokv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
003969b45029bb1cb45c51d4cd3f3d24

Files

003969b45029bb1cb45c51d4cd3f3d24
.exe windows:4 windows x86 arch:x86

389ba5f1c434b2ede3b5eb22b2a0aad2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
FindVolumeClose
GetEnvironmentVariableW
VirtualAlloc
CloseHandle
GetExitCodeProcess
InterlockedExchange
GetStdHandle
ResetEvent
WriteFile
CreateMutexA
GlobalSize
ResumeThread
GetPrivateProfileIntW
GetModuleHandleW
GlobalFree
lstrlenA
CreateEventA
GetACP
GetCommandLineA

advapi32

ControlService
ClearEventLogA
CloseEventLog
RegEnumKeyW
CreateServiceA
RegQueryValueW
RegCloseKey
IsTextUnicode
RegDeleteValueA
IsValidSid
IsValidAcl
RegCreateKeyExW
RegDeleteKeyA

amstream

DllRegisterServer
DllGetClassObject
DllRegisterServer
DllRegisterServer
DllRegisterServer

sysdm.cpl

NoExecuteAddFileOptOutList

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ