599b6cd62b186f70feb586ebe4416d88 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

599b6cd62b186f70feb586ebe4416d88
Size

43KB
MD5

599b6cd62b186f70feb586ebe4416d88
SHA1

01347194341179690d12290a1e1da1b5f8b230ea
SHA256

46a5d7be261f2a00b29056645633f0c5cb07faec12aabd368ac5ee36651a2396
SHA512

ea972e71fbb0940f65793a0e1229abeb128a5eab11f2d5972ec3fde3db772aa2fb1be195675eff6c894d0504c754f8fa8f275b9e79796ceaf9f61d806f55a46a
SSDEEP

192:JrBqmMsjk0mjtHw7kuRzu9clgSaOzBWziKqDT:67MtmtHLTuraBuKqD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
599b6cd62b186f70feb586ebe4416d88

Files

599b6cd62b186f70feb586ebe4416d88
.exe windows:4 windows x86 arch:x86

dd9474d27b987bdc6093c05deb4436c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigA
OpenServiceA
QueryServiceLockStatusA
LockServiceDatabase
OpenSCManagerA
QueryServiceStatus
StartServiceA
ControlService
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA

user32

ExitWindowsEx

kernel32

LocalAlloc
GetVersionExA
CloseHandle
GetCurrentProcess
LocalFree
GetLastError
Sleep
GetTickCount

netapi32

NetUserGetInfo

msvcrt

printf
exit
calloc
wcscmp

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ