047e727e60decb6bdc043d2a3d2339b8 | Triage

Sharing

General

Target

047e727e60decb6bdc043d2a3d2339b8
Size

448KB
MD5

047e727e60decb6bdc043d2a3d2339b8
SHA1

0366a02c49dae96d1f68851a13666a61ecd799a3
SHA256

34a9ec931a64174025d96b1c89a55d8c0b50bd56f292e9ea4f3c0988aa7152d9
SHA512

38b4543f78be089c1c5bc4a7a3549b239dd70f33b99a2a07430adf08a3d11734f42a22ecec8316bca804c98803b2f2c9bbc24a76ffb316289cdd97ce9795c56e
SSDEEP

12288:wrBh4Fcia8U2qu4CH8LOHBLphwMxSfavHeWGpHv9GQT65:w34FtU23rrbGMbfUFGQTA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
047e727e60decb6bdc043d2a3d2339b8

Files

047e727e60decb6bdc043d2a3d2339b8
.exe windows:5 windows x86 arch:x86

c130a2a20d4971a6eef1840a6164aca0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DuplicateTokenEx
ImpersonateLoggedOnUser
RegOpenCurrentUser

Sections

0
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.4Q3l3
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ