0944f1b19c57061091db394607d5ebe9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0944f1b19c57061091db394607d5ebe9
Size

13KB
MD5

0944f1b19c57061091db394607d5ebe9
SHA1

5b1e06cb5830c9b258408497f7c25c2081e3e2d7
SHA256

c847767757a071e09a587c0d68d0a175c26247e7bcebd53c8d4179235f8f63c0
SHA512

c77db848c7c67bb6885921da6aadb28ee95ba5ea8569b1b38ffb36fae59188540cdce2a7b1f5886bf191fe302b96d2b094918dbef7f31352580580b5d73ba614
SSDEEP

96:CxlOTR4GBpsciXVIbpwid2JAE4oynGJs:CxlOTRDps7VIF2KE4oyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0944f1b19c57061091db394607d5ebe9

Files

0944f1b19c57061091db394607d5ebe9
.exe windows:4 windows x86 arch:x86

8b5d26a41e38ddceccb2ef9d3d571833

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
OpenProcess
GetCurrentProcessId
CopyFileA
GetSystemDirectoryA
CloseHandle
CreateProcessA
WinExec
GetProcAddress
LoadLibraryA
Sleep
DeleteFileA
FreeLibrary
GetModuleFileNameA

user32

wsprintfA

advapi32

RegOpenKeyA
RegSetValueExA
RegCloseKey

msvcrt

memset
__getmainargs
atol
_initterm
strcmp
strcat
??2@YAPAXI@Z
_chkesp
strcpy
_exit
_XcptFilter
exit
__p___initenv
__set_app_type
__p__fmode
__setusermatherr
_adjust_fdiv
__p__commode
_onexit
_except_handler3
_controlfp
__dllonexit

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 423B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ