3a9f8f3747e58c8b804e33ec28e4c79a | Triage

Sharing

General

Target

3a9f8f3747e58c8b804e33ec28e4c79a
Size

67KB
MD5

3a9f8f3747e58c8b804e33ec28e4c79a
SHA1

ab7751d546c1b3e086f778baa7864c18e689eb62
SHA256

19187eef952c287e1b9e1b2659eb14dd835c35f373e001e62a8c03b07ce36fbd
SHA512

2f47f51f6848800aa73e10132116a2e6800ff25f1eaa2aba521e5b03c668a1a07b12051a1952ac53dbd3f2c460ec3414544ef943a6022e452d9a0f9574073206
SSDEEP

1536:ROB9Qm9qIufPSCILc/WBYYPaR9GZbqg8m+IvJEZ:W9N9puKY/CxBF5EIhu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a9f8f3747e58c8b804e33ec28e4c79a

Files

3a9f8f3747e58c8b804e33ec28e4c79a
.exe windows:4 windows x86 arch:x86

89b6e8f974d97b0420c1c83d725a37c5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetCommandLineA
ExitProcess
GetStartupInfoA
GetComputerNameExW
QueryInformationJobObject
GetLocaleInfoW
GetCommMask
GetCurrentDirectoryA
BeginUpdateResourceW
LocalUnlock
GlobalDeleteAtom
DebugBreak
_lopen
OutputDebugStringA
GetFullPathNameA
GlobalGetAtomNameW
FindFirstFileExA
VerifyVersionInfoW
CompareFileTime
SignalObjectAndWait
lstrcmpiA
Module32NextW
GetConsoleAliasExesW
GetTapePosition
FindFirstVolumeMountPointA
FreeUserPhysicalPages
SetEndOfFile
GetComputerNameExA
GetExitCodeProcess
CreateSemaphoreA
SetThreadExecutionState
ReadFileScatter
CreateWaitableTimerA
GetHandleInformation
CreateNamedPipeA

Sections

code
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

data
Size: 45KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ