626f4eb71325533184d998c93c30fbfb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

626f4eb71325533184d998c93c30fbfb
Size

92KB
MD5

626f4eb71325533184d998c93c30fbfb
SHA1

db62283f9ac21ec3a574955d3efdc9999ea3468e
SHA256

f013935f4e161c7648b424983e2c2eeb7e45b16fa532787352990d968077ff5b
SHA512

5ae6cd8112414961d737d117ad3b2464f6691081d6740be265c78d0f736804f7340807f02a7f1c38b51a0611bb208f390c6e36a3eb1570a6589a4a0fd9833aa2
SSDEEP

1536:abi5I6FpSZtlCd8hWEe9WiLEyPCCCxOdInoh5SOF8:aOO6PSZtlLhWEe9WiIdvxEpXSO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
626f4eb71325533184d998c93c30fbfb

Files

626f4eb71325533184d998c93c30fbfb
.exe windows:4 windows x86 arch:x86

9f79575d52303490fa563e6710cba7c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GlobalLock
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

RtlFindLeastSignificantBit
RtlNewSecurityObject
ZwLockVirtualMemory
ZwSetUuidSeed
ZwOpenSymbolicLinkObject
ZwAllocateUuids
NtFlushInstructionCache
RtlSetUserFlagsHeap
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
ZwReadVirtualMemory
strcpy
towlower
RtlpNtQueryValueKey
ZwLoadKey2
sin
NtSetIntervalProfile
NtOpenObjectAuditAlarm
ZwCreateToken
NtCancelDeviceWakeupRequest
RtlSplay

Sections

.text
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

weIJUNLi
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ