535702f1cf9569b2dda76d8d475cf7ac | Triage

Sharing

Copy URL Twitter E-mail

General

Target

535702f1cf9569b2dda76d8d475cf7ac
Size

322KB
MD5

535702f1cf9569b2dda76d8d475cf7ac
SHA1

cf0ba8dd65283a2027808d03d29ec1846db3dc74
SHA256

c251c74e671bba2f2e8eedd05bf39df5d3f1a4a91487733b22b66bad42eb23a9
SHA512

2af4ef779fd050e1c40a3e4ab5b85b9df101e246b44a1a988d1d7a325daff37cf7fad4d511c3e732a7da8004e44571e2254e2181592e2eb88a7b2a49ba049b08
SSDEEP

6144:Nn+u2lhFj/bo3PNLF6eIAHLp4LkB5HweW4rQgED5rY0PGp1oEIlK:Nf2Fj8/NLF6eIArp4+5H/svW0PG0Eq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
535702f1cf9569b2dda76d8d475cf7ac

Files

535702f1cf9569b2dda76d8d475cf7ac
.exe windows:5 windows x86 arch:x86

c9c3c6261dfbe929f032d11ee5a1e61c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

NdrDllCanUnloadNow
CStdStubBuffer_Connect
IUnknown_AddRef_Proxy
CStdStubBuffer_CountRefs
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Invoke
NdrOleFree
IUnknown_Release_Proxy
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer_Release
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Disconnect

ntdll

_itoa
NtAllocateVirtualMemory
NtAdjustPrivilegesToken

Sections

.text
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE