794d64d1e288cb5206239dd3b8099432 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

794d64d1e288cb5206239dd3b8099432
Size

16KB
MD5

794d64d1e288cb5206239dd3b8099432
SHA1

20631a403a91dec835403591110a2e9cbb8ad4ae
SHA256

87b7061dbd349081a8a492fe6346adaca8b8af6487f2bcc90c8d8c51afa16640
SHA512

cb58e2ec28eb8f55e670abdf13573c8ea07da041f741861ac40aff6e7d8b80ceeca9287510c02213b031c6c3a713faabbf0c309e3d5323a263f56241d380965b
SSDEEP

192:yQBggb9Q2bekJBqhzCIIIQlTtGSdxOjoEMIpLTK1yS9XnHSMUF8:yQ3bXykJBqhz9QhtGSdYDT/S9XHSbO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
794d64d1e288cb5206239dd3b8099432

Files

794d64d1e288cb5206239dd3b8099432
.exe windows:4 windows x86 arch:x86

802dcac7aab948c19738ba3df9f356d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
strcmp
memmove
memcpy
strncpy
strlen

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapAlloc
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetTickCount
TlsGetValue
CopyFileA
WriteFile
HeapFree
CreateFileA
SetFilePointer
GetFileSize
ReadFile
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsFree
GetLastError
SetLastError
WaitForMultipleObjects
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore

Sections

.code
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 5B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ