0a7c96e1562a49cc2967246cb5c62ac0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a7c96e1562a49cc2967246cb5c62ac0
Size

820KB
MD5

0a7c96e1562a49cc2967246cb5c62ac0
SHA1

3ea77bea3ebedca6261715ac89c2e73fa4ef58fe
SHA256

40d478950715855c65a9f5ee34db8baff66326e94130bef98b7354e5a693ff04
SHA512

d899371b578487f3a76e2914bedc0353c0bff4114351cb98bfe17946b626bb4a47e51d0be3c3911eecd3aa5153ff3b24b2ccf0f6b6cc22fd230416f018a46d3f
SSDEEP

12288:68RM0YskuYXg9KjIFpeLh1TLa+HjH6+NJ+XukhAbMWYKStR42HojcFRXdt1X:NRMYkuMUpeF1T+o8XukhkMWHQvRN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a7c96e1562a49cc2967246cb5c62ac0

Files

0a7c96e1562a49cc2967246cb5c62ac0
.exe windows:4 windows x86 arch:x86

fea2637fe0139cda73a85b0209e20885

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableA
SuspendThread
GetPrivateProfileIntA
FreeConsole
lstrlenA
GetStdHandle
CloseHandle
LocalFree
VirtualAllocEx
CreateEventW
ResetEvent
GetCommandLineW
GetSystemInfo
WriteFile
LocalSize
InterlockedExchange
LoadLibraryW
CreateMutexW
GlobalFree
ReleaseMutex

advapi32

RegCreateKeyExW
RegQueryValueW
ClearEventLogW
InitializeSid
RegCloseKey
CloseEventLog
RegEnumKeyA
CreateServiceW
RegDeleteValueA
ControlService
IsValidSid
IsTextUnicode
IsValidSecurityDescriptor
InitializeSid

fwcfg

InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 809KB - Virtual size: 808KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ