02a366b1e59404e6c63ef509ceeed0c9 | Triage

Sharing

General

Target

02a366b1e59404e6c63ef509ceeed0c9
Size

7KB
MD5

02a366b1e59404e6c63ef509ceeed0c9
SHA1

00f9d8b27d9101dc3521dede20cfad9243fe84dc
SHA256

42f120001d18644cf2164314cd25abed299f86b58433c8d4b429c240bbe7d0b4
SHA512

96ca9454b314902a13b096981ec738a6efee5859d7b7f66697af12bd2fee9ad25faf240ae311d3766739e1da667387d43b900313a8164303d1410895638b619a
SSDEEP

192:zDMSsO5Z5syGwovKSGf+CB0jryVlIV+/v8i:zIS7vsySKinr0IV+v9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02a366b1e59404e6c63ef509ceeed0c9

Files

02a366b1e59404e6c63ef509ceeed0c9
.exe windows:4 windows x86 arch:x86

cf38970ffb77b3887ff1e8e3229bac57

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
lstrcatA
WideCharToMultiByte
lstrcpyA
WaitForSingleObject
CloseHandle
SetFileAttributesA
GetModuleFileNameW
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
SetEvent
CreateThread
GetProcAddress
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
InterlockedExchange
VirtualQuery
GetProcessHeap

gdi32

SelectObject

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE