54f159ecf729abdba47ba4621d204c45 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

54f159ecf729abdba47ba4621d204c45
Size

20KB
MD5

54f159ecf729abdba47ba4621d204c45
SHA1

200ab097b30fc55713db0ed2d39e9e5a8ff3b55d
SHA256

bd950230e69fcf7b239e78983c0cb8dea1a93ad4b52753b39bcdc2cae98ec5fe
SHA512

98bd1a92bf86b0293eb816b65f2ec2a75f2a9347f6d73690b071dea5a2f2df594102e72908a29546870221b3720d712b3be591bb47f0c42f4dfb30f97b7b8e99
SSDEEP

384:Sou2JUqSKU+w9y/4KqTfqnmOlaIuL/AUzfBrz5q:Sou2JrSKc9y/4KqDtOlH+AUxl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54f159ecf729abdba47ba4621d204c45

Files

54f159ecf729abdba47ba4621d204c45
.exe windows:4 windows x86 arch:x86

04d7740fc722be3c56ea871570ce2580

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetSystemDirectoryA
LockResource
LoadResource
FindResourceA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
Process32Next
lstrcmpiA
Process32First
TerminateProcess
SizeofResource
Sleep
CopyFileA
GetLastError
DeviceIoControl
MoveFileA
GetWindowsDirectoryA
DeleteFileA
FreeLibrary
LoadLibraryExA
lstrcatW
GetWindowsDirectoryW
GetVersionExA
GlobalFree
GlobalAlloc
WriteFile
CloseHandle
FreeResource
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
GetProcAddress

advapi32

OpenServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyA
RegSetValueExA
ControlService

shell32

ShellExecuteA

msvcrt

fprintf
strcat
strlen
fclose
fopen
strcpy

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ