670cd01bc62d565184ba0c3e0f91a2ed | Triage

Sharing

General

Target

670cd01bc62d565184ba0c3e0f91a2ed
Size

12KB
MD5

670cd01bc62d565184ba0c3e0f91a2ed
SHA1

f812736992a4ac316c98de538ba5a463e42b13b1
SHA256

c640898917dfa07fa8483a02cfc41a41ccb7912261fce7adfb0a4f2614a39caa
SHA512

d79a77d2bc7315b91b4297dca7394af572ed57ddb0d17c608a6ce33b8b2fb01800ca2d6f5b1ea9b1b04e5468aad33a0b0012f96103890d6598a7ef6a53dbaa27
SSDEEP

192:Ge/Oe8NR/eETFuUpSlkXWD6/cLFjpSFBtHy7bMHDstvyhwt5hqXiW/8AoWEpM:BF8NttzppfyXeSvyhwt5hxW/8AoWwM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
670cd01bc62d565184ba0c3e0f91a2ed

Files

670cd01bc62d565184ba0c3e0f91a2ed
.exe windows:4 windows x86 arch:x86

f6efd8020654e3bf28b6c173ddfb3b4c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
MapViewOfFile
CreateFileMappingA
GetFileSize
UnmapViewOfFile
WinExec
GetTempFileNameA
GetTempPathA
Sleep
GetSystemDirectoryA
CreateFileA
LoadLibraryA
GetPrivateProfileStringA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetWindowsDirectoryA
FreeLibrary
GetLastError
CopyFileA
DuplicateHandle
GetCurrentProcess
GetProcAddress
CloseHandle
LCMapStringA
WideCharToMultiByte
RtlUnwind
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shlwapi

PathAppendA

Sections

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ