4f3898d4bab063ab43344b7bd84b43c6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4f3898d4bab063ab43344b7bd84b43c6
Size

17KB
MD5

4f3898d4bab063ab43344b7bd84b43c6
SHA1

c4e8a6f6d8e2d6f66012cd338a0f0396af027f82
SHA256

107a655df7133415ea09f3014631d6e16e3a22e1db5cda4e850300dc66e6a7f5
SHA512

43eafbdff2818c16da8b2ac9c0ea695f568d0a7450ead007d927f259892ebb707b4fe3f16bbfbb08bbffcaea395031eff4ae9f04044d25b660895240f4e88b22
SSDEEP

192:/jKYeqKsSTSX7oaofOvoRurYqRK05e5SgH0qvfF6VAVZvvYQiv0/0:/m8KsI2VjBYPLHHFwqZ3fs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f3898d4bab063ab43344b7bd84b43c6

Files

4f3898d4bab063ab43344b7bd84b43c6
.exe windows:5 windows x86 arch:x86

db3aff9c104148a2e7544e6d8b4565be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
GetEnvironmentVariableA
CreateFileA
GetProcessHeap
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent

advapi32

RegOpenKeyExW

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ