3faf98ae8d5c15b7594522a5856f559d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3faf98ae8d5c15b7594522a5856f559d
Size

12KB
MD5

3faf98ae8d5c15b7594522a5856f559d
SHA1

d31f8591556b512a781c46fc4555eacb96f1dfba
SHA256

77f59c580e58c92953c7ffe9993fe18c2b81841e28bb210021e3adead2935d9c
SHA512

00459ba969c720768c564e61748b34fe300a48f4b6890e6875efce7795b0eaed6ff8ad50c3cd27e0ad46ed9205f7aaf5a90ed8d057e78ce81c685a8e9b8777e1
SSDEEP

192:DnHk/ihp8Q6iw4HGkgKLFlufDXwVUcXd3fps5RvLCV40oyBLb2:DHVp8QqwfgKLFlcTktJRQRvLW1oyBLS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3faf98ae8d5c15b7594522a5856f559d

Files

3faf98ae8d5c15b7594522a5856f559d
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE