0b00b61ac3890e8128572175bc8ecf05 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b00b61ac3890e8128572175bc8ecf05
Size

26KB
MD5

0b00b61ac3890e8128572175bc8ecf05
SHA1

7065ba6280b71f4a912a05f9e9ffcf31924869d3
SHA256

40b4c529f0d246c556da7ab0cf93000a5a0ce1b9f46dcd90099a8e703154bc77
SHA512

b72c00629fe1f59fa783df510c6f541f0c41d82331c7baa0fbc37eca94c0053d02e9814c4b79e0b66c44ed3844053939281d0c05c05744a0f7af87e471657438
SSDEEP

384:LH8yxTgpgj6N8nzmtVHV6YSA0RIL70KKx+arNU3b8swUXbG:T1Teg68nEqI0KKx+arkxXbG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b00b61ac3890e8128572175bc8ecf05

Files

0b00b61ac3890e8128572175bc8ecf05
.exe windows:4 windows x86 arch:x86

7b495eae7b8e66007ec5eac1cc5fddf4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenA
CloseHandle
WriteFile
CreateFileA
lstrcatA
Sleep
GetTempPathA
GetModuleFileNameA
LockResource
SizeofResource
LoadResource
FindResourceA
GetSystemDirectoryA
CopyFileA
CreateThread
OpenProcess
GetStartupInfoA
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
lstrcmpiA
GetTickCount
ExitProcess

user32

wsprintfA

advapi32

SetServiceStatus
OpenSCManagerA
CreateServiceA
StartServiceA
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
CreateProcessAsUserA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA

shell32

ShellExecuteA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ