faf9027aee5ed78c54743ae5337460b1 | Triage

Sharing

General

Target

faf9027aee5ed78c54743ae5337460b1
Size

73KB
MD5

faf9027aee5ed78c54743ae5337460b1
SHA1

bf4cbb7be9f46732ee8ea0e8105bd470e5587916
SHA256

7154c3646168338ca529ebd6f0a531ab9939b79352d9cad27273fde9c1e399af
SHA512

cd9a83295ad1433663016f96670ebeff9ca250d29cd7e00d89ad6294ecb5f1cd97fffea41a2debeeac2d3d26f6f21f52d55218473e56edc5492955f25a69c54b
SSDEEP

1536:ACUnLApmGtaFrmH+MpJc+8JhXlR9ceq3WU:AmyFrYHJdMhXtQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faf9027aee5ed78c54743ae5337460b1

Files

faf9027aee5ed78c54743ae5337460b1
.exe windows:4 windows x86 arch:x86

64bc9219a31e011ab17d7969582ff6bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
LoadResource
SizeofResource
FindResourceA
CreateMutexA
OpenMutexA
LockResource
CloseHandle
GetStartupInfoA

advapi32

GetUserNameA

msvcrt

strcmp
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ