39762bd41eb3d73e54a82aea0e3d1203 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39762bd41eb3d73e54a82aea0e3d1203
Size

36KB
MD5

39762bd41eb3d73e54a82aea0e3d1203
SHA1

5dd847d505cf504653ff7606cea0aac1b7b81a4e
SHA256

9753fbad63d9dfb67ec5214cb608af412c4bfb921e1836cd9e6220fe7a91fc7e
SHA512

06e8acdef7d6c7d370a4c4e3d2c108afa52c9e5b487d51acd20a063cb45de7b9c16fcb6497bbcea9933e02eb681070b63b37f8e950b2cab14efd680c6db7c1b0
SSDEEP

768:LCBs5L6vUjC3bDmMt3rj8e7LY/p/arYK3S5/waauQglrQP2:OBhU4jf8Y01aUKixZrl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39762bd41eb3d73e54a82aea0e3d1203

Files

39762bd41eb3d73e54a82aea0e3d1203
.exe windows:4 windows x86 arch:x86

da27de3586b9a2aef7fcf350b26b7681

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleA
CreateProcessA
DuplicateHandle
GetCurrentProcess
OpenProcess
Sleep
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
GetComputerNameA
WriteFile
CreateRemoteThread
GetSystemDirectoryA
GetFileSize
GetModuleFileNameA
DeleteFileA
SetFileAttributesA
GetCurrentThread
ExitProcess
GetStartupInfoA
GetCommandLineA
SetFileTime
GetFileTime
SetLastError
GetCurrentProcessId
VirtualFree
VirtualAlloc
GetPriorityClass
WaitForSingleObject
VirtualFreeEx
GetWindowsDirectoryA
CreateFileA
CloseHandle
SetFilePointer
ReadFile
lstrcpyA
GetTempPathA
CreateThread
ResumeThread

user32

FindWindowA
GetWindowThreadProcessId
wsprintfA
MessageBoxA

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA
OpenProcessToken

shlwapi

SHDeleteKeyA

msvcrt

atoi
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_EH_prolog
free
malloc
strncpy
strchr
_stricmp
_strnicmp

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE