327ba282c200a2c5d26760a1abf5fe7a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

327ba282c200a2c5d26760a1abf5fe7a
Size

382KB
MD5

327ba282c200a2c5d26760a1abf5fe7a
SHA1

9e2d06e8941411c485ad045701bfaf2a12156bda
SHA256

1ea44ee70bf14ac47a5c9a78d02f54b065fac2e4be2baaf4162ac21009742552
SHA512

1a21ed7f3371db8ca239f80f8f2778da8d6c2c255fe3ad9be8f0ce4be2a728cef221f34e1c4d0a64c1ae8351959db45c5536436ee21366704f05d96b1cae616d
SSDEEP

6144:o12BRM50I8mJ+ehSemWfSZSzuhgrE9dYCb8xf4I7GVltNyEe6EofQKKfnGIYt3yo:5RM50I8mJlmWp6hgricAQG3Xxai5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
327ba282c200a2c5d26760a1abf5fe7a

Files

327ba282c200a2c5d26760a1abf5fe7a
.exe windows:4 windows x86 arch:x86

da7891dbcce33e65ce48d40b5473ed69

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
ResetEvent
InterlockedExchange
FindVolumeClose
GlobalFree
CloseHandle
CreateEventA
ResumeThread
GetStdHandle
GetModuleHandleW
CreateMutexA
GlobalSize
VirtualAlloc
LocalFree
GetCommandLineA
GetPrivateProfileIntW
lstrlenA
GetACP
GetEnvironmentVariableW
GetExitCodeProcess

advapi32

IsValidSid
RegCreateKeyExW
CloseEventLog
CreateServiceA
RegDeleteKeyA
IsTextUnicode
RegDeleteValueA
ControlService
RegCloseKey
RegEnumKeyW
RegQueryValueW
IsValidSecurityDescriptor
ClearEventLogW

asycfilt

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

hdwwiz.cpl

InstallNewDevice

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ