31200a8ca31c60803fa2895428519dbe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

31200a8ca31c60803fa2895428519dbe
Size

16KB
MD5

31200a8ca31c60803fa2895428519dbe
SHA1

50b0330648f391ae3f8cd6971314034e9e3c7cda
SHA256

1609e2594d11471139fffabe8c8c586ad7ab07ba7f4e905c4f1a743fc3d9c78b
SHA512

7a280e2e34b38f81247e07f46a2801f4fa6063827031d431da3bcd3116b183ffeb2f97b87a30615b6c0ca75bb6f8b76b8094abbff3f88c4ccfbb2a3924f9423c
SSDEEP

384:8PA5FdnR6gFCEoCOXwW3igBmlSphP3eX2psSB9MJ9Bgyp7p3PO7:qA7v6fJXUgglSph2XfgMIypN3W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ProcessKiller.exe

Files

31200a8ca31c60803fa2895428519dbe
.zip
ProcessKiller.exe
.exe windows:4 windows x86 arch:x86

65cd17f6d9c0a3bb0b7d6c6bd7d58021

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
DeleteFileA
ExitProcess
FindAtomA
GetAtomNameA
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fclose
fflush
fopen
fprintf
fputs
free
malloc
signal

shell32

ShellExecuteA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE