023c198c826bd88ff0ffa39f952f2f4d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

023c198c826bd88ff0ffa39f952f2f4d
Size

12KB
MD5

023c198c826bd88ff0ffa39f952f2f4d
SHA1

f90d9b8dcca634e1261537ed64aa458c488ad607
SHA256

45d373e88d90856f57679b530b24db3554aee49e4496f0f32e31ff992d42bba7
SHA512

7ebfb4bd8995adf61a20039ebfd93ae2eb9e59f86164a13596e587cc7d736ecad8f7c194e86920a41e0540a724e2ddb2340b6fdae6781c314045a486e7a3f2b5
SSDEEP

192:LMhs1ua1z0uhFMGBqNTkYKy+glPDY68F2Pdg4JXQPxq0EHp1tIwwHHwDvfYEs/v:w/aWCMKwKytbqoEUH/u1HHwDvfYTv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
023c198c826bd88ff0ffa39f952f2f4d

Files

023c198c826bd88ff0ffa39f952f2f4d
.exe windows:4 windows x86 arch:x86

3fd876e965279cc9a9e8aec36b1e450d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualQuery
DeleteFileA
lstrcpyA
SetFileAttributesW
CloseHandle
GetModuleFileNameA
LoadLibraryA
GetProcAddress
lstrcatA
GetFileAttributesW
GetModuleHandleW
GetCurrentProcess
FreeLibrary
InterlockedExchange
RtlUnwind
ExitProcess
GetModuleHandleA
GetCommandLineA
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
GetFileAttributesA
GetTempPathA
OpenProcess
TerminateProcess
Process32First
CompareStringA
VirtualAlloc
HeapReAlloc

user32

CharToOemA
wsprintfA
ExitWindowsEx
BeginPaint
AnyPopup
MessageBoxA
ReleaseDC
ShowWindow

gdi32

RestoreDC

advapi32

RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegOpenKeyExA
LookupPrivilegeValueA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE