71c6b83e0fbfaa1b9de0c48f31d38dc4 | Triage

Sharing

General

Target

71c6b83e0fbfaa1b9de0c48f31d38dc4
Size

69KB
MD5

71c6b83e0fbfaa1b9de0c48f31d38dc4
SHA1

3622ceafdd9d881a0ac64bdb957e520d704e3357
SHA256

75f089f51377c5758978bff2449a8ec0a2abcf140d1e4d1f194bf6f048805330
SHA512

7aafaba50300025d00ac1e8b57debb3ee735380aa4c1ed3c18bf91754ba870fcf81b1eba269646e890066bb7cbabb5d2d06a1d3f0d3d755e1cd1804a51778eac
SSDEEP

1536:85AfDJS6K0zF5DYqThOH/CtjsLL8ABezdQhYhdd:8GDJSXmTC/C1sLL8ABezWh+d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71c6b83e0fbfaa1b9de0c48f31d38dc4

Files

71c6b83e0fbfaa1b9de0c48f31d38dc4
.exe windows:4 windows x86 arch:x86

4534843d17559399a20c04431a616df5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
FreeLibrary
GetTempFileNameA
CloseHandle
GetModuleHandleA
lstrcmpiA
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

NtCreateSection
RtlConvertExclusiveToShared
NtSetEvent
ZwAccessCheckByTypeResultListAndAuditAlarm
NtCancelIoFile
NtListenPort
NtOpenIoCompletion
ZwPrivilegedServiceAuditAlarm
RtlInitAnsiString
NtAccessCheckByTypeResultListAndAuditAlarm
ZwSetSystemEnvironmentValue
ZwShutdownSystem
NtFlushVirtualMemory
RtlAllocateAndInitializeSid
ZwTestAlert
ZwStartProfile
RtlRemoteCall
RtlFreeSid
ZwConnectPort

Exports

Exports

IsMbmenngjpff

Sections

.nk90
Size: 4KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_PAGELK
Size: 60KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ