56d2ff0a032120e747774cb3f424e077 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56d2ff0a032120e747774cb3f424e077
Size

12KB
MD5

56d2ff0a032120e747774cb3f424e077
SHA1

591edf643f7db434788639a149c62dcff13ac4ca
SHA256

938c78cbbfa8dbbeda3a397bc6380c3ccf01fa648e3bbb9930d4c99d9e93259f
SHA512

561038d39b6d9d17b8cda30744ae3ea5f89b113290cdb0ac0555faf6f2c11c2786a200d265d7b801fa713a3fcbfe180d1c3e0c858840a7a21032ca0e9daa1fee
SSDEEP

192:C+0hqKkS2hTepSzPlEZ10Gs/MGaI1uNIKy+oLNPrY68vUDwNo9XgnNmMWbUQg+p4:CnqD5eDEGIMMVKy3RbPNwKggQqie1Yv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56d2ff0a032120e747774cb3f424e077

Files

56d2ff0a032120e747774cb3f424e077
.exe windows:4 windows x86 arch:x86

18d900d041f9fe2d99e58948a6f05ec7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
OpenEventA
SetEvent
Sleep
lstrcatA
DeleteFileA
lstrcpyA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
CloseHandle
ReleaseMutex
GetFileAttributesA
SetFileAttributesA
FindNextFileA
ExitProcess
GetModuleHandleA
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
OpenProcess
CreateFileA
GetTempPathA
Process32First
CompareStringA
TerminateProcess
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery

user32

wsprintfA
CharToOemA
MessageBoxA
ExitWindowsEx
ShowWindow

advapi32

RegDeleteValueA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE