ff0bf2b630a59d2bd52d7960d16ab9e4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff0bf2b630a59d2bd52d7960d16ab9e4
Size

23KB
MD5

ff0bf2b630a59d2bd52d7960d16ab9e4
SHA1

7e009ba7aac8c7cf65b4ff67ae9c8478573c8e8a
SHA256

73e9a01ce6c73eba6ea05e3d0e01f2c195cf7bc919340feb803c8fdc7e5abd49
SHA512

1afdb274b9e799be3d49cdbfc416781571f932026e7861204400d3018f198f8ac040fc0843048791eb436fa54bb70cc5d6270b808f1516a94225342d934302fe
SSDEEP

384:0nl8y4QVbQFKK/b1zM3fKY1iwBiS05crcBl+g+Ro8+qMyt0c43UmVg1VYadHYcZp:0n+ytVsbW31iqCcruAg++tbb+1Ld4cmw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff0bf2b630a59d2bd52d7960d16ab9e4

Files

ff0bf2b630a59d2bd52d7960d16ab9e4
.exe windows:5 windows x86 arch:x86

5fa7740a4682fa10447a58bfe0458be8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
Thread32First
lstrcpyW
GetCurrentThreadId
GetModuleHandleA
GetProcessWorkingSetSize
GetSystemTimeAsFileTime
SetEnvironmentVariableW
ReadFile
GetThreadLocale
GetCurrentProcess
GetTempFileNameW
GetCurrentThread
GetCurrentProcessId
GetThreadTimes
CreateEventA
LoadLibraryA
GetSystemTime
DeleteAtom
VirtualAlloc
WaitForSingleObject
GetProcAddress
IsBadReadPtr
VirtualProtectEx
VirtualFree
Sleep
SystemTimeToFileTime

user32

CloseWindow
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
MessageBoxA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ