3a74f6060bca4f0c444d74b148221fcb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a74f6060bca4f0c444d74b148221fcb
Size

99KB
MD5

3a74f6060bca4f0c444d74b148221fcb
SHA1

13608fd38c93670643146d44f1e7d7892361e18c
SHA256

20f67ec5d1bba913a21b4162b33739890c7734c2cee34024a73e6573c27f6c65
SHA512

2004341bf7e7438ff1a9413f44f33a04e1a304e2e9be73890b6d06111b245d2cc996e5eec4b0eb1ee35cc69ede9c3cf0e37e4b507be38d30496e17b60840c4cb
SSDEEP

3072:0cU8tjPuvj+VUKtC4/+tC3Kpy9IHq2+TWvVS6K:0At/o2KYwwt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a74f6060bca4f0c444d74b148221fcb

Files

3a74f6060bca4f0c444d74b148221fcb
.exe windows:5 windows x86 arch:x86

5ca7710df33f99c7de5357a36d0da989

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtFsControlFile
NtCreateThread
ZwFlushVirtualMemory
ZwDeleteKey
NtFlushBuffersFile
NtOpenEventPair
NtGetContextThread

kernel32

WritePrivateProfileStringA
FindNextFileA
GetPrivateProfileStructA
InterlockedExchangeAdd
ReleaseSemaphore
HeapAlloc
DeleteCriticalSection
RaiseException
FindClose
GlobalAddAtomW
GetProcessHeap
SetLastError
CreateDirectoryW
WaitForMultipleObjectsEx
GetThreadPriority
GetSystemDirectoryW
FindNextFileW
GetACP
CloseHandle
LocalAlloc
GetTempFileNameW
Sleep
GetCurrentProcessId
VirtualProtect
GetProcAddress
GlobalUnlock
GetCurrentThread
GetLongPathNameW
GetStdHandle
GetLogicalDrives
CopyFileW
GetStringTypeExW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ