09db6983ae8c3e478d16af5556d182d1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09db6983ae8c3e478d16af5556d182d1
Size

380KB
MD5

09db6983ae8c3e478d16af5556d182d1
SHA1

7f8c331fdb16767bb8dd811dec8a2e52ec4e7d23
SHA256

5bd142ed1ffb7f11394d68a9a935aaf1af94d446baf940f14637c10b9c992e26
SHA512

bd9cab4f717f607f4b434acc68073bf38f06b0d196c7fc79b89f2f1a00bb0bfffaca1aaa2f0895ef640fee1d0a88b11c0b5bf81f9913d3f03e21bb353498199a
SSDEEP

6144:/9uuRMhiWjhtgYXL7TO6dHyF6EDWVUlMVcZOV6fGhmLjAR73t3ygCkv:VuuRMnlbq6Vxh8MV9VOpO73tokv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09db6983ae8c3e478d16af5556d182d1

Files

09db6983ae8c3e478d16af5556d182d1
.exe windows:4 windows x86 arch:x86

7007e039b163c1e98f57c7b9bdc25122

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
WriteFile
GetExitCodeProcess
GlobalFree
GetACP
GetEnvironmentVariableW
GetCommandLineA
VirtualAlloc
CreateMutexA
GetPrivateProfileIntW
InterlockedExchange
ResetEvent
lstrlenA
LocalFree
ResumeThread
GlobalSize
CreateEventA
FindVolumeClose
GetStdHandle
CloseHandle

advapi32

RegCreateKeyExW
ControlService
IsTextUnicode
ClearEventLogA
RegQueryValueW
CreateServiceA
IsValidSid
RegCloseKey
CloseEventLog
RegDeleteKeyA
IsValidAcl
RegEnumKeyW
RegDeleteValueA

admparse

ResetAdmDirtyFlag
ResetAdmDirtyFlag
AdmClose
ResetAdmDirtyFlag
ResetAdmDirtyFlag

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ