565de5fe3cefa7d9114fb4b7070f57ab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

565de5fe3cefa7d9114fb4b7070f57ab
Size

270KB
MD5

565de5fe3cefa7d9114fb4b7070f57ab
SHA1

31515820904c3ef92ff2c2e0633040008187efe6
SHA256

88a9ef6732cb977b83f15700b11d2220247554f8e213391f25cb4cf933f6de31
SHA512

e00b8f5893100dbb97635afa2300993c3566a9afdabdfbc80f20b996f441fc140100b9458f58a7cf605c514ef2fd456312a7e02ad1e84b3d85838708103fcb2f
SSDEEP

6144:9x3yWaiqljm9gB8jJYZ+K8buAHz0zveUOj2Ng3c2:9AWREwdJYZ+Kzu0zveh2Ng

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
565de5fe3cefa7d9114fb4b7070f57ab

Files

565de5fe3cefa7d9114fb4b7070f57ab
.exe windows:4 windows x86 arch:x86

cf9597d48b29ccf780c86fa51d91cc7f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CreateMutexW
ExitProcess
HeapFree
InterlockedIncrement
ReleaseMutex
RtlMoveMemory
SetCriticalSectionSpinCount
lstrcpynW

advapi32

ClearEventLogW
CloseEventLog
CreateProcessAsUserA
DuplicateTokenEx
EqualSid
GetNamedSecurityInfoW
GetSidSubAuthorityCount
GetUserNameA
RegCreateKeyA
RegQueryValueA
RegRestoreKeyA
SetPrivateObjectSecurity
StartServiceCtrlDispatcherA

user32

CascadeChildWindows
CloseClipboard
DdeDisconnect
DrawFocusRect
EnumPropsExW
GetClassInfoExA
GetDoubleClickTime
GetTabbedTextExtentW
GetWindowLongW
IsWindowUnicode
MapVirtualKeyA
MessageBoxIndirectA
RegisterClassA
SetMenuItemInfoW
SetRect

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 266KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ