f898efc63e8297a94a8e3fe2f1c1c059 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f898efc63e8297a94a8e3fe2f1c1c059
Size

93KB
MD5

f898efc63e8297a94a8e3fe2f1c1c059
SHA1

e88dde08ee6d6af818e0b40de1caf1c2250c582b
SHA256

cc5d43d6dc687ff0590dcb024f661bbf71c53fb7026c12ad8c9b22289681adf4
SHA512

bb82912c6906d04276024dce68399ddf73a782595ac8c4d39b3d7e6d8dd55bd01b69bb52f203ab0a5a5d2b7473786ee7a3d2ef466704a13ec28fae0e2881d278
SSDEEP

1536:oEBJdQQirDMVLdcp5DFz1DtJKSoeI4S/LGY6BLHoMT3B36z2EL:oEBcQwmdcTZoe8qYgDHT3ICEL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f898efc63e8297a94a8e3fe2f1c1c059

Files

f898efc63e8297a94a8e3fe2f1c1c059
.exe windows:4 windows x86 arch:x86

100af262ce853fed95f37a1b13e4286f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

exit

advapi32

RegSaveKeyA

user32

wsprintfA

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

sendto

dnsapi

DnsQuery_A

shlwapi

SHDeleteKeyA

Sections

.MPRESS1
Size: 87KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE