0dbf1d460df681d04504499e52ae887f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0dbf1d460df681d04504499e52ae887f
Size

20KB
MD5

0dbf1d460df681d04504499e52ae887f
SHA1

2efef1e36f4d121f0368093dbb668430a0815b11
SHA256

e918a2d2a3940601b36df908af619411561ad27e099cf226cf781d55269aaff4
SHA512

7e3300506bfe349e0adb59491a93ad3c3416ab503e4c3afd39aab5e5bfc2f435398fca86051770eb8bf4c6f10f700c4aa3441f03ce890289703f8126e1aa77d1
SSDEEP

192:+phxRk2CjReihe9BY5vy2z8LKNOHdzJhP1oynC492nP:kAi8y2gZ9zX1p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dbf1d460df681d04504499e52ae887f

Files

0dbf1d460df681d04504499e52ae887f
.exe windows:4 windows x86 arch:x86

9d320776a22a374284b864ef17766325

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
WriteProcessMemory
GetCurrentProcess
GetVersionExA
SetThreadPriority
CreateRemoteThread
VirtualAllocEx
LoadLibraryA
GetLocalTime
GetWindowsDirectoryA
GetStartupInfoA
GetModuleHandleA
GetProcAddress
OpenProcess
FreeLibrary
CloseHandle
WinExec
GetPrivateProfileIntA

user32

wsprintfA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

mfc42

ord5606
ord6663
ord535
ord772
ord3701
ord500
ord825
ord924
ord823
ord5860
ord537
ord800
ord858
ord4129
ord5683
ord4202
ord860
ord540

msvcrt

_controlfp
_acmdln
exit
_stricmp
__CxxFrameHandler
__dllonexit
_onexit
_exit
_XcptFilter
_except_handler3
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE