0011b1afad2b1c1988ba9158924a7658 | Triage

Sharing

General

Target

0011b1afad2b1c1988ba9158924a7658
Size

6KB
MD5

0011b1afad2b1c1988ba9158924a7658
SHA1

2e948fcc69c39c46daa1d63e07be1b9cf2cc8c41
SHA256

9df27b7e3d43162d751df19983aa9d14ed35a7e7d3d675ee28296ad5d97f9fdc
SHA512

fd58bd180ce781d28f5b9196032c88986524c717f0ce31c8b6d2d6521eda9d0870e16cfb286c8c04cdede020645f7230162fe2c5a4c9bb601d33a86ec61b3635
SSDEEP

96:0KLUeYqNv7HIu7vsbiOeOuLRfnK4HNxWqvFm:0G7Yq9DIujsbiO6RvHHNxWqvFm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0011b1afad2b1c1988ba9158924a7658

Files

0011b1afad2b1c1988ba9158924a7658
.exe windows:4 windows x86 arch:x86

c4a206681e099efea8c31e661dc1e66d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
Sleep
GetCurrentThreadId
GetStartupInfoA
VirtualAllocEx
WriteProcessMemory
GetProcAddress
CreateRemoteThread
GetExitCodeThread
CloseHandle
GetModuleFileNameA
FindFirstFileA
GetSystemDirectoryA
FindClose

user32

PostThreadMessageA

advapi32

StartServiceCtrlDispatcherA
ControlService
DeleteService
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerA

msvcr71

_initterm
exit
strcpy
strcmp
strncat
strlen
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
_acmdln
_amsg_exit
__getmainargs
_stricmp
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
_strlwr

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ