fbb8ed6ff00053f4c1cb5608b6c7b75f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fbb8ed6ff00053f4c1cb5608b6c7b75f
Size

125KB
MD5

fbb8ed6ff00053f4c1cb5608b6c7b75f
SHA1

55028b4400c340aa100f84d9c2d9ccc2cb874a6c
SHA256

cb842fd6080dcb3e784fdd696c3e8d1ca959eb2c8107c1aeb445574dbc0921e9
SHA512

0d39f3ee90677bc61a0087c2e70737cac9e1b5ac16971aee28e8a0ead4204fe32136e4d48dee8043a41e156788d543b360834faac107dc6641149380f2316c8e
SSDEEP

3072:FW9iIEIm7QR5KJmErPk40mWx2Ng5u9XyTBf09tl/:qqIrKJbrzWx4Su9XyTBy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbb8ed6ff00053f4c1cb5608b6c7b75f

Files

fbb8ed6ff00053f4c1cb5608b6c7b75f
.exe windows:4 windows x86 arch:x86

e74b75bf91af8f2c720463c8bd39f521

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

GetCurrentProcess
GetModuleHandleA
GetProcAddress
OpenProcess
Process32First
Process32Next
VirtualAllocEx
WriteProcessMemory
lstrcmpiA
CreateToolhelp32Snapshot
CreateFileA
FindResourceA
LoadResource
LockResource
SizeofResource
WriteFile
CloseHandle
CopyFileA
CreateThread
CreateRemoteThread
lstrcmpiW
Sleep
RtlZeroMemory
GetSystemDirectoryA
GetModuleFileNameA
GetFileAttributesA
GetCommandLineW
ExitProcess
lstrlenA

shell32

CommandLineToArgvW
ShellExecuteA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceCtrlDispatcherA
StartServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ