0f3d4330092e56f0e8b868eba1056b54 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f3d4330092e56f0e8b868eba1056b54
Size

55KB
MD5

0f3d4330092e56f0e8b868eba1056b54
SHA1

2fbcac9eaecc0a878c21fcc5606b643784bd0056
SHA256

8f78735c103872be32972744ead8e12e069f09a40d3df46091e945727aaa572f
SHA512

87c64f754cb41fb8b07db4041a0af76c8663cb17bfa48ed80e29d39c1ba2447faac7b53ae3ad5c1d11f840a2a655510e0f7ac45dbde482115bf11d3b40f8ac2c
SSDEEP

1536:Aw8+f3WDFdKyKdxk6Q5+4WNYXqEHlqNUTuD4wmp:xHPWDDKZxr4W8FqNUyD4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f3d4330092e56f0e8b868eba1056b54

Files

0f3d4330092e56f0e8b868eba1056b54
.exe windows:4 windows x86 arch:x86

4259e7dbfeac92097b2bbbc90e5f5d75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

Pie
DeleteObject
SetWinMetaFileBits

msvcrt

_read
free
strcmp
memcpy
__set_app_type
_stricmp
_wsopen
_dup
_itow
_itoa

version

GetFileVersionInfoA

kernel32

SetFileAttributesW
TlsAlloc
SizeofResource
HeapDestroy
SetUnhandledExceptionFilter
VirtualAlloc
GetSystemTime
SystemTimeToFileTime
GetConsoleCP
GetSystemInfo
LoadLibraryExW
HeapReAlloc
ExitProcess
CreateMutexA

advapi32

RegOpenKeyExW
GetUserNameA
AllocateAndInitializeSid
RegQueryInfoKeyA
QueryServiceConfigA
ControlService
RegQueryValueW
RegCreateKeyExA
SetServiceStatus

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 19KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE