1da778bc6a91e51a7306e05aa65c2997 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1da778bc6a91e51a7306e05aa65c2997
Size

26KB
MD5

1da778bc6a91e51a7306e05aa65c2997
SHA1

111de49fc7257c8854856f00b55387a7cc1d431f
SHA256

140f9d474ec6108a078372300f27935a6c72a0307d3d1b10b3534fb460aa6340
SHA512

840811c5f18161c2f04e922dfa261b852b3ace22952e2ec9deb750fd369ccde2da216bc343e12610e81870fe0127b256020336e7d33e8c6c2d618655339161a2
SSDEEP

384:LHYyxwgpgj6N8nzmtVHV6YSA0RIL70KKn1xarN13b8swUXbG:Tpweg68nEqI0KK1xar7xXbG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1da778bc6a91e51a7306e05aa65c2997

Files

1da778bc6a91e51a7306e05aa65c2997
.exe windows:4 windows x86 arch:x86

7b495eae7b8e66007ec5eac1cc5fddf4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenA
CloseHandle
WriteFile
CreateFileA
lstrcatA
Sleep
GetTempPathA
GetModuleFileNameA
LockResource
SizeofResource
LoadResource
FindResourceA
GetSystemDirectoryA
CopyFileA
CreateThread
OpenProcess
GetStartupInfoA
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
lstrcmpiA
GetTickCount
ExitProcess

user32

wsprintfA

advapi32

SetServiceStatus
OpenSCManagerA
CreateServiceA
StartServiceA
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
CreateProcessAsUserA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA

shell32

ShellExecuteA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ