5016f0ff173ebef4efd8067d38044f88 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5016f0ff173ebef4efd8067d38044f88
Size

20KB
MD5

5016f0ff173ebef4efd8067d38044f88
SHA1

8ab002e52bf8e3eeb55f183ee63d01a17b8ebcca
SHA256

02a5e11acd4ab41c3f4135d99f6015a1dd20caecf99153de642b808427ca990c
SHA512

088245e159a0c006cfc48ed466cd7346ee2bc917ae0e7cb886104fe6b554ca756444a4b6accfc715be06b6816125a17f52c65036942c3e02262bfc595cca0bb2
SSDEEP

192:habjA7i9QklywJErLDON5Bk7z8WsP1oyqDyFt4Q9Z1:haPA7iqkl8rvGBaz8314DyFt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5016f0ff173ebef4efd8067d38044f88

Files

5016f0ff173ebef4efd8067d38044f88
.exe windows:4 windows x86 arch:x86

e3015f873d8d5262e795181b395c420f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
CreateFileA
WriteFile
CloseHandle
GetStartupInfoA
GetModuleHandleA

advapi32

RegSetValueExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey

shell32

SHGetSpecialFolderPathA

wininet

InternetCloseHandle
InternetOpenUrlA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoA
InternetOpenA

msvcrt

srand
_XcptFilter
_exit
??3@YAXPAX@Z
_controlfp
ldiv
sprintf
rand
time
_except_handler3
atol
__p__fmode
??2@YAPAXI@Z
__getmainargs
__set_app_type
exit
_acmdln
_initterm
__setusermatherr
_adjust_fdiv
__p__commode

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ