fb22167fc97413536eff77e195112af2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb22167fc97413536eff77e195112af2
Size

820KB
MD5

fb22167fc97413536eff77e195112af2
SHA1

4872dfdc2074000148f60a79408e04228ca73cae
SHA256

8ef9cf28f933ca3b83158ea8d0108f50b635f5fddcb5fa8763a048bf68ec133e
SHA512

be004331a61b70d9c2478d3e8cc64d177899193111d2cf80565ad2801d5e2c6600effdfe9c6ea89f09c5116bc84657d45396c3f120222d9f492bb9f467725d3f
SSDEEP

24576:9hRMbtMnyte4DRTxfsUSSbj5kp4dTpMki:9hRMxMnyteufsU5bjeL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb22167fc97413536eff77e195112af2

Files

fb22167fc97413536eff77e195112af2
.exe windows:4 windows x86 arch:x86

9d8fb7a5d5c6d8a235e307a9d5165fe3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
FindVolumeClose
CreateEventA
GetStdHandle
InterlockedExchange
lstrlenA
LocalFree
GetExitCodeProcess
ResumeThread
GetPrivateProfileIntW
GetEnvironmentVariableW
GlobalFree
GlobalSize
GetModuleHandleW
GetACP
GetCommandLineA
CloseHandle
VirtualAlloc
CreateMutexA
ResetEvent

advapi32

IsValidAcl
RegCloseKey
RegQueryValueW
ControlService
RegCreateKeyExW
IsValidSid
IsTextUnicode
CloseEventLog
RegEnumKeyW
CreateServiceA
RegDeleteValueA
RegDeleteKeyA
ClearEventLogA

admparse

ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
AdmClose
ResetAdmDirtyFlag

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 810KB - Virtual size: 810KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ