678f0677eab045f3f47ae35bf0f772ab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

678f0677eab045f3f47ae35bf0f772ab
Size

344KB
MD5

678f0677eab045f3f47ae35bf0f772ab
SHA1

c3d1dfdf0202383ff5ac7487c9b49eb42daf9ada
SHA256

9a48ae780319bf385344d4d2e66d5501faedac3cf78b18c77db4eae6aff73693
SHA512

e8021582e963d6eacb7b1aa8befd32c8bc35035cba24dda8210963da85fd4de5ccebab8ec9db5579b51f0aaffe4a903f89aa75bfc592f00daba8629b4335642c
SSDEEP

6144:at9sN+68MJh6ZV7YbPXGjyyg/Uel680EXe7:at9sN+TIPXGj/aUel6xEXA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
678f0677eab045f3f47ae35bf0f772ab

Files

678f0677eab045f3f47ae35bf0f772ab
.exe windows:4 windows x86 arch:x86

8b53af7395cccfc07e9646fce6a478f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
GetSystemDirectoryA
GetLastError
GetModuleHandleA
VirtualProtectEx
GetTempPathA
GetProcAddress

advapi32

ConvertSidToStringSidA
DeleteAce
CopySid

avifil32

EditStreamSetNameA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 292KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ