20b57ab7fbebd635b155ae8656ff14c5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20b57ab7fbebd635b155ae8656ff14c5
Size

2.2MB
MD5

20b57ab7fbebd635b155ae8656ff14c5
SHA1

c775e541449f5c28b367aff9930b09f3c79afa54
SHA256

5a17676988ccf82ff4e8724dae15376a88f17485ac558864d756453ad26119c7
SHA512

0c3e86416ff5f6b321fd2b0337b229b08f8464a8f3efd2350d6f3f738056ca71f55ce2774e462f73245566f7b944593e6826a10e566e32bab91df645cc0f9d77
SSDEEP

24576:6/9TqeLZaFK3cwH3CslRun+eqxbQMqeFfz7R4Y0lPYyFyuYnR4M5sNsgLuv0az/2:0TFvXCslEmT1nWY0FFyuetXQs0a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20b57ab7fbebd635b155ae8656ff14c5

Files

20b57ab7fbebd635b155ae8656ff14c5
.exe windows:4 windows x86 arch:x86

f52b20a62c9aa9d74136fd0f34e7e5de

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ExitWindowsEx

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

kernel32

WriteFile
lstrcatA
GetModuleHandleA
CloseHandle
CreateFileA
DeleteFileA
ExitProcess
FindResourceA
FlushFileBuffers
GetCurrentProcess
GetFileSize
GetModuleFileNameA
GetProcAddress
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
LoadLibraryA
LoadResource
LockResource
MoveFileExA
MultiByteToWideChar
ReadFile
RtlMoveMemory
RtlZeroMemory
SizeofResource

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ