249ae898dc43a4e1740aff45cc75576f | Triage

Sharing

General

Target

249ae898dc43a4e1740aff45cc75576f
Size

499KB
MD5

249ae898dc43a4e1740aff45cc75576f
SHA1

e47518951f3ab9e4c8d7445451c82538309da42a
SHA256

58e6c0a877acdd268f151db87ac4249e69c6ffb5a2390dd7541925d9726027da
SHA512

1ddc90243b82a595bf73a2e9e67aa78b9cf6a8f5e508bc24d11480fe1c3c89f147cbcb0f90182fc35fcd0dcce388a3abc3923b3fb5223fe64b084ea4f1b4a13e
SSDEEP

6144:UYH/+A65HJx5s9XJI/5FA0OZUFgkcjNE/sLZ4P+gufZd5Yw7rc9:vx66XJIRFA7UfcjNUYZk+Tv7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
249ae898dc43a4e1740aff45cc75576f

Files

249ae898dc43a4e1740aff45cc75576f
.exe windows:4 windows x86 arch:x86

aaad3101bc3ceefe61068764ee39be5d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetACP
TlsAlloc
GetStartupInfoA
GetStdHandle
GetEnvironmentVariableA
lstrlenA
CreateFileA
TlsGetValue
ReleaseMutex
CreateFileMappingA
IsBadStringPtrA
CancelIo
HeapDestroy
GetModuleHandleA
ResetEvent
GetModuleFileNameA
HeapCreate
ResumeThread
SetEvent
GetCommandLineW

advapi32

CreateServiceW
IsValidSecurityDescriptor
IsValidAcl
RegCreateKeyExW
ControlService
CreateProcessAsUserA
InitializeSid
RegDeleteValueA
RegEnumKeyA
IsValidSid
IsTextUnicode
RegQueryValueW
ClearEventLogW

tspkg

SpLsaModeInitialize
SpLsaModeInitialize
SpLsaModeInitialize
SpLsaModeInitialize

timedate.cpl

CPlApplet

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ