1b9f7c5aa350d2c48e0781ba4a3d0f19 | Triage

Sharing

General

Target

1b9f7c5aa350d2c48e0781ba4a3d0f19
Size

338KB
MD5

1b9f7c5aa350d2c48e0781ba4a3d0f19
SHA1

6692415eebeddb54dca9e5439c7a18028624a801
SHA256

95716d2dac7db41dc89d6705efa931ff613696385443654dfcd95ca89d36e146
SHA512

4d33608196558bbe470ebe18b0f994a4b811a41b17c7b1d22f1ff9472e1f23245135daa9c801cb4f5dadc268082409fd8366d6267b178fa11c75a9d22f14149a
SSDEEP

6144:YRx5mI15S4Y3dhpvFS5rO5RQUuchKcbsLqQARr0MZN6ykvk:E7n15SZdhRQxO5mbcsyAHgr0o6zvk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b9f7c5aa350d2c48e0781ba4a3d0f19

Files

1b9f7c5aa350d2c48e0781ba4a3d0f19
.exe windows:5 windows x86 arch:x86

a8dfe11d84c50d8140f2bea48f778a7a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
GetCurrentThreadId
OutputDebugStringW
FreeLibrary
SetCurrentDirectoryW
GetModuleFileNameW
GetCurrentDirectoryW
GetStartupInfoA
GetTickCount
QueryPerformanceFrequency
IsDebuggerPresent
RaiseException

user32

CharNextW
UnregisterClassA
FindWindowA

odbc32

SQLFreeConnect

advapi32

RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExW

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.init
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 810KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ