tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

226KB
MD5

e73d8e164ed06e09b6498889fe13a1fc
SHA1

67478aaf4d923fec66f59b3a14deceee7524849e
SHA256

2b32362603fd8ba0983290c5d7743ebd39b51d91ffbdf79bf4f9163570d97f12
SHA512

44df8d5d681bac5891a0260e8fa63cdf1871fea491d2a4580052aad335208f133389e757d95c644fd87dd122fdc851d8ee51ccff036f84f646764917b99ace41
SSDEEP

3072:o2Zy6jQPTBWxIvw+B+JmMbFmOZSnN+xnt9mAM/h81m/q4b9gjaaSpG40B:o2nTyvw+dMbZCN+lCiYSG9pq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:5 windows x86 arch:x86

546f33d512573bdb791de14ef85160bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileExA
HeapAlloc
GetTickCount
GetConsoleAliasesA
TzSpecificLocalTimeToSystemTime
LoadLibraryW
GetLocaleInfoW
IsProcessorFeaturePresent
GetAtomNameW
CompareStringW
SetConsoleTitleA
RaiseException
InterlockedExchange
GetLastError
FindResourceA
GetTapeStatus
SetComputerNameA
LoadLibraryA
LocalAlloc
WritePrivateProfileStringA
SetCurrentDirectoryW
OpenJobObjectW
FreeEnvironmentStringsW
GetStringTypeW
CompareStringA
EndUpdateResourceA
UnregisterWaitEx
EnumCalendarInfoExA
LocalFree
GetProcAddress
GetEnvironmentVariableW
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
WideCharToMultiByte
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale

advapi32

RegisterEventSourceW

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

546f33d512573bdb791de14ef85160bf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 135KB - Virtual size: 135KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 7KB - Virtual size: 14KB

.tls Size: 2KB - Virtual size: 2KB

.rsrc Size: 66KB - Virtual size: 2.0MB

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 7KB - Virtual size: 14KB

.tls
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 66KB - Virtual size: 2.0MB