09ba64d588670ba15c2995bcb6669535 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09ba64d588670ba15c2995bcb6669535
Size

28KB
MD5

09ba64d588670ba15c2995bcb6669535
SHA1

85352b748faca240d586d906b7fb98a2b1290909
SHA256

79f25738d99db567d0f4df647c0b0fe7ded17d8d31662dbcb9af286a0f3c7244
SHA512

3debf789d5aeacb07de2880235bf2e5232fc95fd99bd9cd541c8ec21ad9f890eee4ce2c43e68f85034179181a3477c022f021131036d8dc16815eccaaceb5497
SSDEEP

768:jwSnZHboTw4OPYr8ksn8WxN9wB1Xvf6hQ5n0LX:USnZHboTwxM8RVN9U1XvepX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09ba64d588670ba15c2995bcb6669535

Files

09ba64d588670ba15c2995bcb6669535
.exe windows:4 windows x86 arch:x86

165332d0b8316b9c330a16511ad61fcf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

isspace
strcpy
isdigit
memcpy
rename
strcat
strstr
memset
_EH_prolog
__CxxFrameHandler
strcmp
strlen

user32

wvsprintfA

kernel32

GetModuleHandleA
ExitProcess
HeapReAlloc
HeapAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetProcessHeap
HeapFree
GetCommandLineA
GetStartupInfoA

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ