251f527907a1835247d710a439395b22 | Triage

Sharing

General

Target

251f527907a1835247d710a439395b22
Size

42KB
MD5

251f527907a1835247d710a439395b22
SHA1

c89b82cb562480d402ab1953cab20e5538fed061
SHA256

77fe623ac74864a8af2d98395f7fbd99b45a9fe40a8a8bc421819dacb9ffbb75
SHA512

31745ad206a8595943205a861c72568d2af91073255532ca3ed0de826912e838c6721f36b8ef3ff663ca5dbf987f82a2985c6fb97ca281bbd0a439351134afef
SSDEEP

768:OT1e0WvanQ2zOXVioc8S+ZVR/f174evgcUc+4KYtjKgn3EEsUQERkFv69Q0ZCMIT:OT1emvzOXVO+Z//f+evzM4KGjrn3EEsT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
251f527907a1835247d710a439395b22

Files

251f527907a1835247d710a439395b22
.exe windows:4 windows x86 arch:x86

b3b10456de9fa97ac691865577e41356

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
AdjustTokenPrivileges

msvcrt

exit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
tolower
strstr
time

kernel32

CreateRemoteThread
OpenProcess
VirtualAllocEx
GetStartupInfoA
DeleteFileA
CopyFileA
CreateProcessA
GetVersionExA
GetCurrentProcessId
LoadLibraryA
Sleep
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcmpiA
GetModuleFileNameA
BeginUpdateResourceA
FindResourceA
CloseHandle
GetCurrentProcess
VirtualFreeEx
WaitForSingleObject
GetSystemDirectoryA
WriteProcessMemory
GetProcAddress
GetModuleHandleA
LockResource
LoadResource
lstrcatA
GetLastError
CreateMutexA
EndUpdateResourceA
WriteFile
CreateFileA
SizeofResource

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ