15e89a4199d53824248fca468361e7b5 | Triage

Sharing

General

Target

15e89a4199d53824248fca468361e7b5
Size

21KB
MD5

15e89a4199d53824248fca468361e7b5
SHA1

5b82df344d912eb5bbf81dc224c4c1c2e47dc4cb
SHA256

c1c51abbbfa86bd249ba6fb23cc86307a453d461893b2f1beee7e86231a7b024
SHA512

6f9733c556a261e859ec06d71eb6a7aab999037f67adc192778f972ff43d31463c7670c55202fd1edeb1634170c9476972e7a9f99f5fdbab0eb5fcdded311ed4
SSDEEP

384:doK9nu+kwPkGKkLxS8j20ni/cHcIVDTsuSBp:doK4+5PkGKkVXniocI2uSB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15e89a4199d53824248fca468361e7b5

Files

15e89a4199d53824248fca468361e7b5
.exe windows:4 windows x86 arch:x86

a110dcd73da1b5482f505fcbab9a1105

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
LockResource
LoadResource
FindResourceA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
Process32Next
lstrcmpiA
Process32First
TerminateProcess
GetCurrentProcess
CreateFileA
GetLastError
DeviceIoControl
MoveFileA
GetWindowsDirectoryA
DeleteFileA
FreeLibrary
CopyFileA
lstrcatW
GetWindowsDirectoryW
GetVersionExA
GlobalFree
LoadLibraryExA
GlobalAlloc
SizeofResource
WriteFile
CloseHandle
FreeResource
GetModuleHandleA
LoadLibraryA
Sleep
GetProcAddress

advapi32

OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyA
RegSetValueExA
ControlService

shell32

ShellExecuteA

msvcrt.dll

fprintf
strcat
strlen
fclose
fopen
strcpy

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ