25f0a0566e6f639b6aaa8a3c0bff0638 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

25f0a0566e6f639b6aaa8a3c0bff0638
Size

7KB
MD5

25f0a0566e6f639b6aaa8a3c0bff0638
SHA1

28ee579262c9e46816d1e0bd36da774d1623c0f0
SHA256

a448e570674d56bfd52f4b318ffd62893176e04444cc72cd4e6367f6fbc82493
SHA512

6b022b0e99ff93e81b2789f778a3585964578c2beccf043e3ad2472096665f4e588a35cacc2075bf84805f875a650a306b1b167b31c49dfa538a8ad0db689580
SSDEEP

96:kEtwOREXKnGy4aG6yXmlunvM3f8uMHui:k8mKGhSeG0uCui

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25f0a0566e6f639b6aaa8a3c0bff0638

Files

25f0a0566e6f639b6aaa8a3c0bff0638
.exe windows:4 windows x86 arch:x86

90b4d62cdf2b30b121e1b78057242dc5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenEventW
GetFileAttributesW
GetProcAddress
GetModuleHandleA
PulseEvent
lstrcatA
GetSystemDirectoryA
CreateEventA
lstrcatW
lstrcpyW
GetCurrentProcessId
CompareStringA
WaitForSingleObject
WideCharToMultiByte
CloseHandle
ExitProcess
GetCommandLineA
SetEvent
CreateThread
ExitThread
CreateProcessA
Process32Next
Process32First
CreateToolhelp32Snapshot

user32

ShowWindowAsync
wsprintfA
DestroyWindow
CloseWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

advapi32

RegCreateKeyW
RegOpenKeyW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE