0f527b054c9d4c27303f248cc28deea8 | Triage

Sharing

General

Target

0f527b054c9d4c27303f248cc28deea8
Size

23KB
MD5

0f527b054c9d4c27303f248cc28deea8
SHA1

d2fa24ca8611911b6664efb3f428d7e2cef4a239
SHA256

8a542fb2cfd4f6dfd4817f563f055d13da901b5f10b1f98eea3cd00aec316ad3
SHA512

0811934f089fbf3a99d6c0a292203a958babf8be64641cef4c31285df4cec426018d23e0e1e939750d31ea226f361ecd3d4a87d362211234f4244ea36b54d842
SSDEEP

384:r8u5LXq9MY8HEyXeDBxRCDoeW/8AoWtBYkkjuv1hkNLdbaLa4CwUJuUCSFCJWe8T:rh7wMZHEya3QDoEArBxkjuv7wbaLa4Py

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f527b054c9d4c27303f248cc28deea8

Files

0f527b054c9d4c27303f248cc28deea8
.exe windows:4 windows x86 arch:x86

337324dcab20b34a728a2a415a998e0d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
MapViewOfFile
CreateFileMappingA
GetFileSize
UnmapViewOfFile
WinExec
GetTempFileNameA
GetTempPathA
Sleep
MoveFileExA
CreateFileA
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetWindowsDirectoryA
FreeLibrary
GetLastError
DuplicateHandle
GetCurrentProcess
GetSystemDirectoryA
CloseHandle
LCMapStringA
WideCharToMultiByte
RtlUnwind
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shlwapi

PathAppendA

Sections

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ