tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

227KB
MD5

0941f4d9ee26277365c146779a43b36f
SHA1

e223594e07afa06074629c673b40285f58ae68bc
SHA256

88a9bedf9126d29cde6131457acc413cf8b555cc0abec2aaca275f0b85fd479b
SHA512

d1ff9f5c910523918667ad63be620b056ee2e308a3e3877c389d0624c148ddd4239fc00a50e63a3bf19b05416335e47339f14eb8d69eaee455f72edd84404cf7
SSDEEP

3072:chrVLLNVnlkEJmIjIlbclf4HtwAu9SFTc5g2Tu:kLh9lkEJzjl4NGSFF2T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:5 windows x86 arch:x86

700b0dd8274fa766006677f2cd2b64ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\yayo51 woyusayuv\taxabimohez\kuzanol-cegegibuko-lajudibul.pdb

Imports

kernel32

QueryDosDeviceA
AddConsoleAliasW
SetCommBreak
GetSystemDefaultLCID
GetTickCount
LoadLibraryW
FatalAppExitW
FreeConsole
SetComputerNameExW
CreateJobObjectA
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
SetVolumeLabelW
ReadConsoleOutputAttribute
RemoveDirectoryA
LoadLibraryA
WriteConsoleA
LocalAlloc
FindNextChangeNotification
GlobalFindAtomW
GetModuleFileNameA
FindFirstVolumeMountPointA
GetModuleHandleA
GetFileAttributesExW
DeleteFileW
GetCurrentProcessId
MoveFileWithProgressW
DebugBreak
AreFileApisANSI
MoveFileW
InterlockedDecrement
MultiByteToWideChar
GetModuleHandleW
Sleep
ExitProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
WriteFile
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
RtlUnwind

advapi32

GetAce

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 38.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

700b0dd8274fa766006677f2cd2b64ed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 126KB - Virtual size: 126KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 19KB - Virtual size: 38.9MB

.rsrc Size: 69KB - Virtual size: 69KB

.text
Size: 126KB - Virtual size: 126KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 19KB - Virtual size: 38.9MB

.rsrc
Size: 69KB - Virtual size: 69KB