57b76640312d3a69afec7ce434e21a34 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

57b76640312d3a69afec7ce434e21a34
Size

69KB
MD5

57b76640312d3a69afec7ce434e21a34
SHA1

fa426bef204a17f66779249e47a606c2cbb31896
SHA256

fdb404614739392b2585f0a800dd581cfc02009d5947e166ab7d7c81e1724ffc
SHA512

bcd1407e2720ef372f25e0db06313902baed4832f3bd8a81854855d501fc3d63dc153de2e7a081392f40c0c0c4eca09d20ac3de401733a481d5d81c3fde4f4f1
SSDEEP

1536:2cNAIwRjv7+gf+yREi8NBOs/MNgB8AMWYe:2caRLwi8NBOs0NgCAlYe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57b76640312d3a69afec7ce434e21a34

Files

57b76640312d3a69afec7ce434e21a34
.exe windows:4 windows x86 arch:x86

a5f5e38ae5277f44816b843ca8900dc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileA
CloseHandle
lstrcpyA
GetFileSize
ResetEvent
FindFirstFileA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
HeapFree
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteProcessMemory
GetProcAddress
GetModuleHandleW
VirtualAllocEx
lstrcatA
GetCurrentProcessId
ReadFile
SetFilePointer
CreateFileA
WriteFile
GetModuleFileNameA
SizeofResource
LoadResource
FindResourceA
GetCurrentProcess
CompareStringA
lstrlenA
CreateProcessA
GetSystemDirectoryA
OpenProcess
GetFileAttributesA

user32

wsprintfA
ShowWindow

gdi32

GetStockObject

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ