f8e4013b3ff151354ecca060e3540484 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f8e4013b3ff151354ecca060e3540484
Size

32KB
MD5

f8e4013b3ff151354ecca060e3540484
SHA1

d3eef89e3af6c7ef464f74bbef795b100f764ef9
SHA256

cff903452f11d374cdc99cf7a385faca581a62fcfd9df99a0af0f9ec796b5b11
SHA512

8b631ee5f22f75b4a6b6ccabc8bee99db36fb7f36ed48421208d33fdcc9bd7b9e85afd29157e5bb13e27daa8e9087224e29172e6237da49f051ab34ef46efbbf
SSDEEP

768:iPKEAMR6e8jH/I9+J+cXM3iC7AmssreoFC2AhQT24r+GCv/c3:iPZRD+IEvXoksyos/QAh6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8e4013b3ff151354ecca060e3540484

Files

f8e4013b3ff151354ecca060e3540484
.exe windows:5 windows x86 arch:x86

43b28c9d1898be2194e726aaf0482458

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
lstrcmpA
lstrlenA
lstrcpynA
lstrcatA
GetModuleHandleA
GetStartupInfoA

advapi32

CheckTokenMembership
FreeSid
AllocateAndInitializeSid

msvcrt

exit
_acmdln
_XcptFilter
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
__getmainargs

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 815B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ