3995ef783c35e3542fb4c5249ddb4498 | Triage

Sharing

General

Target

3995ef783c35e3542fb4c5249ddb4498
Size

13KB
MD5

3995ef783c35e3542fb4c5249ddb4498
SHA1

ba8abda7aca337e1d4edd5f7efa13c571b113a28
SHA256

e875e597e5416a6ca4e77ee99431d97854c046ba123fa4eb3cc3d9111076146a
SHA512

1830dfcc043557473303c0574c7c678013cb885f618c660d8cdba47a7bd27162248548252e4a806d6697f2b85f8b6278b995218aad97a3b6769abcac5ddcc6f1
SSDEEP

192:jgiddz1Ey+TdQ5Xcr/IxwWm8UFbkwRYoIRtXbemy6swIw:ciDadQ5XS/IxwKUFQwcRtXk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3995ef783c35e3542fb4c5249ddb4498

Files

3995ef783c35e3542fb4c5249ddb4498
.exe windows:4 windows x86 arch:x86

74116e291d077e4d50b4d8b7f12d8480

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateProcessA
DuplicateHandle
FreeLibrary
GetCurrentProcess
GetProcAddress
GetThreadContext
LoadLibraryA
OpenProcess
OpenThread
ResumeThread
SetThreadContext
SignalObjectAndWait
SuspendThread
TerminateProcess
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WriteProcessMemory

ntdll

NtQuerySystemInformation

stealtha

SetRes

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ