0ad6c28110660de1deffdc3983a18638 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ad6c28110660de1deffdc3983a18638
Size

5KB
MD5

0ad6c28110660de1deffdc3983a18638
SHA1

9ac513746a06bb5f11f80c5b4f4219ad9e75bc3f
SHA256

1543f06fcbfdd4f612a79afb4c79fe1111b66080a3bd1c526b3e78d324d1904f
SHA512

af5424e4557f61c81b4d1201a0950335afeb28e807ba5b975d64f90ec247584e6d0ff8e5175e90d323ea068ef53fa481ec852d388a22dfff6628d924958d395c
SSDEEP

96:OqGU8iVTqYawwDwwu+MZkQ0AMejL2dYckGvKlrsAf/2su7ZXij:eti1BDwcweZkQlMenoYckgKlrnf/Iw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ad6c28110660de1deffdc3983a18638

Files

0ad6c28110660de1deffdc3983a18638
.exe windows:4 windows x86 arch:x86

56e492ce405563418b2fb9a9451cb9b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
LoadLibraryA
CloseHandle
lstrcmpiA
lstrlenA
lstrcatA
GetLongPathNameA
GetTempFileNameA
GetTempPathA
DeleteFileA
CreateFileA
lstrcpyA
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualFreeEx
GetModuleHandleA
OpenProcess
ExitProcess
WinExec
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
Sleep
WaitForSingleObject
CreateThread
GetComputerNameA
GetLastError
CreateMutexA
TerminateProcess
CreateProcessA
GetStartupInfoA
SetErrorMode

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
GetUserNameA

shell32

FindExecutableA
ShellExecuteA

msvcrt

sprintf
strrchr

ws2_32

send
recv
WSACleanup
closesocket
shutdown
connect
gethostbyname
inet_addr
htons
socket
WSAStartup

urlmon

URLDownloadToFileA

Sections

FAMDiy
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bak
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE