4afba9968de461000a2761a95f66689f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4afba9968de461000a2761a95f66689f
Size

3KB
MD5

4afba9968de461000a2761a95f66689f
SHA1

b7b11db24567230104764dc861f3af32eb4778a2
SHA256

8f05f4f10be3a90bac6dde7043800c514b906a14c86c4c006139ba1f7deca0e9
SHA512

ea99d06ae9919ea8632c594606be3e996799bd1d5a8789391f17183d55dbc100c38f080df4a999e35756ca1a97e07e3a44874a756246318b4288548af8037f63

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4afba9968de461000a2761a95f66689f

Files

4afba9968de461000a2761a95f66689f
.exe windows:4 windows x86 arch:x86

b131604620b2ce1a5390878956121ed7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
wsprintfA

kernel32

CreateToolhelp32Snapshot
ExitProcess
GetCommandLineA
GetLastError
GetProcAddress
LoadLibraryA
CreateRemoteThread
Process32First
Process32Next
Sleep
SuspendThread
Thread32First
CreateProcessA
VirtualAllocEx
WriteProcessMemory
lstrlenA
CloseHandle
OpenProcess
Thread32Next

wsock32

connect
WSAStartup
recv
send
socket

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA

shell32

StrStrIA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE