7d0acd6c1c82f7b3ac20d9012226dd69 | Triage

Sharing

General

Target

7d0acd6c1c82f7b3ac20d9012226dd69
Size

148KB
MD5

7d0acd6c1c82f7b3ac20d9012226dd69
SHA1

34b37fadcd32214daad4f85eb9446aa3314fa71a
SHA256

e7630e6609e3e7982bc1c0e8feeee57bd12222744e882d72d2533c2fbafbd0c1
SHA512

b47349d2afe85bc5fc7d72cc90276b49b55b4da263c06e5c92a5922bdfbf64c6fe1347bf06ee5c655a7e535986a051aba33e3a730f0c835138a2e002339a0d40
SSDEEP

3072:gresyUFTLjOW6CSpE6Y0mgHZaXGGGLGGGGGGGGGGoOGGGG+kzIZ2yi3x:grRLjOWdSpEX0HHZaXGGGLGGGGGGGGGY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d0acd6c1c82f7b3ac20d9012226dd69

Files

7d0acd6c1c82f7b3ac20d9012226dd69
.exe windows:4 windows x86 arch:x86

888f2eaf4904a2fa18a31963f5446aec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetStringTypeA
LCMapStringW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
GetStringTypeW
RtlMoveMemory

liao

GetNewSock

rasapi32

RasSetEntryPropertiesA
RasSetCredentialsA

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ