0738ab32f9426392d284183361e0d8b0 | Triage

Sharing

General

Target

0738ab32f9426392d284183361e0d8b0
Size

24KB
MD5

0738ab32f9426392d284183361e0d8b0
SHA1

af43b3eeff5ee03d00499016c5d94c17ff294fd9
SHA256

53bf262830fa7e39f79ff27aa43d0cf63c76a2d481f706da03629ddae7775494
SHA512

c1e32fbdc1f99d054c809336779ec9e12a6766d19de9a825755ecf73808d8a2440970c134ec4deadaf2814641699227e2d93c00eb2bcc909d86c0a40fda6350c
SSDEEP

192:KCFEIW9H9i9s9G9h9aOUUMGDryPOKVY68KUBxZY1VBta1lyhCgErZsivIw5RoT/v:KI5mGMMtKVbnSrNvIw5RoTv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0738ab32f9426392d284183361e0d8b0

Files

0738ab32f9426392d284183361e0d8b0
.exe windows:4 windows x86 arch:x86

5387ace276ee8fd832f421de50d2471e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetModuleFileNameA
VirtualQuery
FreeLibrary
RtlUnwind
HeapReAlloc
DeleteFileA
GetCurrentProcess
ResetEvent
GetProcessHeap
GetCommandLineA
GetFileTime
GetModuleHandleW
GetProcAddress
InterlockedExchange
CloseHandle
VirtualAlloc
ExitProcess
GetModuleHandleA
OpenProcess
GetShortPathNameA
GetEnvironmentVariableA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
lstrcpyA
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
HeapFree
HeapAlloc

user32

MessageBoxA
ExitWindowsEx
wsprintfA
ShowWindowAsync
IsWindow
CharUpperA

advapi32

RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyExA

shell32

ShellExecuteExA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE