f8e0e60197de021d214a859568029595 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f8e0e60197de021d214a859568029595
Size

119KB
MD5

f8e0e60197de021d214a859568029595
SHA1

fe9313c211a80ba85c1dbdbf790d9509aa0d3d86
SHA256

7914c6bbe6cab74b2d26ff05ca4da02b0e36f2714dd8f154220cd465488a46d7
SHA512

5f71dd7bfd8c73341466ccc530fd46a58e06424f628d9b247849e329de5e6a0a3d6a6985d64936c0d0b00b0b70ad380d1341181d34b66c2141e9d20061a19cc6
SSDEEP

3072:QFloDoqywBllQOh7i7owtgzLM+3yuCsatmYYHsB:3AOh7i8wtgfM+3p6ZYHsB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8e0e60197de021d214a859568029595

Files

f8e0e60197de021d214a859568029595
.exe windows:4 windows x86 arch:x86

f558e3fe81e5a10175897986187cae39

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
FreeLibrary
FindResourceA
GetWindowsDirectoryA
GetShortPathNameA
LoadResource
LockResource
SizeofResource
DeleteFileA
LoadLibraryA
GetStartupInfoA
GetModuleHandleA
GetVolumeInformationA

advapi32

RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcrt

strlen
strcpy
srand
_acmdln
fwrite
fopen
sprintf
strcat
_exit
_XcptFilter
exit
rand
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??2@YAPAXI@Z
fclose

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ