568f429ae648197bc42e616f49b397ce | Triage

Sharing

General

Target

568f429ae648197bc42e616f49b397ce
Size

382KB
MD5

568f429ae648197bc42e616f49b397ce
SHA1

7612e198cb81777013336398903f40736d80704a
SHA256

7d70da6d8dc46ab237d8ddba048c4dce0660003d460b423adb14c783e145ce76
SHA512

1b7fae7fc728173a48e9786781dc37248598e77824626c43c473a29584a443c815588739e0b7301a22191ae3c5fb27c05f44aab98bbb18c8ea6b95eac98ec80b
SSDEEP

6144:HjZRMYnI8mJ+ehSemWfSZSzuhgrE9dYCb8xf4I7GVltNyEe6EofQKKfnGIYt3yKN:HtRMYnI8mJlmWp6hgricAQG3Xxai5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
568f429ae648197bc42e616f49b397ce

Files

568f429ae648197bc42e616f49b397ce
.exe windows:4 windows x86 arch:x86

5597d06b03dd6bc4feffdb0a8f3410e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntW
WriteFile
LocalFree
VirtualAlloc
GetExitCodeProcess
GetACP
ResumeThread
CloseHandle
GetCommandLineA
GlobalSize
InterlockedExchange
GetEnvironmentVariableW
CreateEventA
GetStdHandle
lstrlenA
GlobalFree
ResetEvent
CreateMutexA
FindVolumeClose
GetModuleHandleW

advapi32

RegEnumKeyW
RegQueryValueW
IsValidSid
RegCloseKey
CloseEventLog
IsTextUnicode
RegDeleteKeyA
RegCreateKeyExW
ClearEventLogW
ControlService
RegDeleteValueA
IsValidSecurityDescriptor
CreateServiceA

asycfilt

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

hdwwiz.cpl

InstallNewDevice

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ