236b6e8745486ac50b2a9cdd2b965c5c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

236b6e8745486ac50b2a9cdd2b965c5c
Size

560KB
MD5

236b6e8745486ac50b2a9cdd2b965c5c
SHA1

991fcca2def17f63235efd54700267e4520ea4a1
SHA256

55e00eda4b4e443eb459575ead5dab364f7a07340d8b0f0045b7c76f5a44e7b0
SHA512

231db8c35c9a84a4996be4b7de4375d44d7d2f67ad05f85b0c8c6da00ae7dc621943716bdc5ad6f1c32f038ba4c60c7742232601e9352532165229e406f89895
SSDEEP

12288:37ZVlxhMMnMMMMMzeu7nT5sNpGr5mrkRBhA5k57HPrGatRQsBgWVB0KzpFSfVgZK:3dVlxhMMnMMMMMCu7nTYUOkCe57vrzXM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
236b6e8745486ac50b2a9cdd2b965c5c

Files

236b6e8745486ac50b2a9cdd2b965c5c
.exe windows:4 windows x86 arch:x86

4ff83917ca6de65f5f545793edd604e5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rtutils

TraceDumpExA

ntdll

NtQuerySemaphore
RtlAddAccessAllowedObjectAce
NtAllocateVirtualMemory
RtlAdjustPrivilege

ddraw

DirectDrawCreate

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 380KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE