127f7dd40188b15e4085d2f4b7ad9f67 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

127f7dd40188b15e4085d2f4b7ad9f67
Size

77KB
MD5

127f7dd40188b15e4085d2f4b7ad9f67
SHA1

baf7d0db27061a074313335eb53232411fb3de98
SHA256

52567ce5332a7c3658d358b4a6222962b104ed6a7980f50b8f543e411b62e600
SHA512

247989c544758db0ee8c0dad0dc81d45bbcd272ccf2428495101b7f982803b86db455d6d2f7acb87b15d9f8d809c83db87d3670c977761c1c981bac7529a8d11
SSDEEP

768:2nfXhm9Ucww06UtISdGlH+CIpymrhtJ8r/Kjj414+:2sacvU6JIpy8mrM814+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
127f7dd40188b15e4085d2f4b7ad9f67

Files

127f7dd40188b15e4085d2f4b7ad9f67
.exe windows:4 windows x86 arch:x86

c838f391a7e36f83c41493e04bbcad2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
CloseHandle
CreateProcessA
ReadFile
WriteFile
WaitForSingleObject
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcessId
GetCurrentProcess
SetFilePointer
CreateFileA
GetModuleFileNameA
SizeofResource
LoadResource
FindResourceA
Process32Next
Process32First
CreateToolhelp32Snapshot
CompareStringA
lstrlenA
lstrcpyA
GetSystemDirectoryA
CreateRemoteThread
GetFileAttributesA

user32

wsprintfA

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ