6123bc9a297632ed8a768d4e2abf8781 | Triage

Sharing

General

Target

6123bc9a297632ed8a768d4e2abf8781
Size

35KB
MD5

6123bc9a297632ed8a768d4e2abf8781
SHA1

a9e409a88f72a3a1a38236cbda0fc8208321d6cc
SHA256

33bbdf2f3d3a89d728310373f395a9de6008b543c04229989cad6d6eeabddf31
SHA512

f5baf74736e2b3da5bbdf511d2b0a96392943e22131436fddd7a25168f5ade3411e1bf47c66fac0b6e893bf4936835c2f942ef898e87185ebb27088db34fdec7
SSDEEP

768:HYpo1SYndYUkICEV3luHD9t8riw2QXQyV:7SPECE3ew9Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6123bc9a297632ed8a768d4e2abf8781

Files

6123bc9a297632ed8a768d4e2abf8781
.exe windows:5 windows x86 arch:x86

761568868ed56277d545e5e62736e31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
lstrlenA
WaitForSingleObject
SetEvent
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcatA
GetEnvironmentVariableA
GetFileSize
CreateFileA
GetComputerNameA
HeapFree

user32

wsprintfA

advapi32

RegCloseKey
GetUserNameA
SetEntriesInAclA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wuaqcua
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE