71dacee8d5ef95f3b5874a01f1a4b29a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

71dacee8d5ef95f3b5874a01f1a4b29a
Size

28KB
MD5

71dacee8d5ef95f3b5874a01f1a4b29a
SHA1

666381a67746b4e9b6fe75609925d7650eb02b71
SHA256

91f667c18bbb15b555bf91cc6d86be1202898e6ace9745a9a0a3411a04fa34de
SHA512

d59791412491d5eacbca4293e47800e5acc872989cb0210d9a0186800ac75b8df1d1719b091b6b6de6354f0e6e7bbcd4909744e52ee88b434f1d0c63c108b57b
SSDEEP

768:ssaUOSbnMSTc68r31RZCQvVXuDifZipQAaIea:1Vdw68hm8rgK1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71dacee8d5ef95f3b5874a01f1a4b29a

Files

71dacee8d5ef95f3b5874a01f1a4b29a
.exe windows:4 windows x86 arch:x86

b20ec6b215f9ff3cc6013b812756191e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetEnvironmentVariableA
lstrcatA
LoadResource
GetShortPathNameA
GetModuleFileNameA
LockResource
SizeofResource
LoadLibraryA
GetProcAddress
lstrcpyA
FreeLibrary
GetModuleHandleA
GetStartupInfoA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

shlwapi

SHDeleteKeyA

msvcrt

exit
free
strcat
calloc
strlen
fclose
fwrite
fopen
malloc
strcmp
sprintf
memcpy
_exit
_XcptFilter
strcpy
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ