28635eca203b438e918f87a9201ab5e6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28635eca203b438e918f87a9201ab5e6
Size

56KB
MD5

28635eca203b438e918f87a9201ab5e6
SHA1

29612076cc5501c12b8d32fe81e458934f77264c
SHA256

ad149b8e78e518e17a955655897aa3154e23bdee4b8b142397894a921fd98e23
SHA512

127387d076d48e93ea7dc4d7f310e71fc065213ee55da2851e91ef0af6bf2f0cac155bc09fdcdf379a59154b8c11c2de2e5094023651dec8e012e195a48bad20
SSDEEP

1536:CPI96rvA2HjBAGcx8/VKxSJsFqyUkXOfpq:aAGo8/VxsFWkXM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28635eca203b438e918f87a9201ab5e6

Files

28635eca203b438e918f87a9201ab5e6
.exe windows:4 windows x86 arch:x86

1c998c0c9f2bccc471cd9d0159024c47

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
MoveFileA
Sleep
DeleteFileA
GetTempPathA
GetLastError
lstrcpynA
GetLocalTime
GetModuleFileNameA
GetTempFileNameA
lstrcatA
CloseHandle
CreateFileA
WriteFile
ReadFile
lstrlenA
lstrcpyA
GetVersionExA
GetTickCount

user32

wsprintfA

advapi32

ControlService
StartServiceA
DeleteService
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegSetValueExA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA
SHGetSpecialFolderPathA

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
strlen
fopen
fwrite
memset
free
malloc
fclose

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE