01bb943ca4912e47dde08dddd3ac3f85 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01bb943ca4912e47dde08dddd3ac3f85
Size

114KB
MD5

01bb943ca4912e47dde08dddd3ac3f85
SHA1

307ff92482b1c7c9221117c6ef09ada3694740ee
SHA256

bb0b92b5a96fa299be626c6feee8ec39bff5ecc92b90a18c62f7ba056914c308
SHA512

c2a2bd8890a9d052bb0ed32cef326f229780a9fbe406c7db6b1317f5a123459e5773e673fddfabe42c5b45a6d0866eef2138af2db89ef50bd7acdd2a02c8eebd
SSDEEP

3072:cG3i5xE3idA9NiYBz552SfPnzmhLQ2eK:cGMm3C8iY/52SHzmhLFe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01bb943ca4912e47dde08dddd3ac3f85

Files

01bb943ca4912e47dde08dddd3ac3f85
.exe windows:4 windows x86 arch:x86

ce070fc3396134126b6cb20077c379d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
GetProcAddress
GetModuleHandleA
VirtualProtectEx
VirtualAllocEx
lstrcpynA
lstrlenA
ReadFile
CreateFileA
WaitForSingleObject
FreeLibrary
LoadLibraryA
Sleep
CopyFileA
lstrcatA
GetSystemDirectoryA
HeapFree
VirtualAlloc
GetFileSize
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
ExitProcess
GetProcessHeap
HeapAlloc
CloseHandle
OutputDebugStringA

user32

wvsprintfA

advapi32

OpenServiceA
QueryServiceStatus
OpenSCManagerA

shell32

ShellExecuteExA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ