8d9a4898c2f3790ddefdfa470b65bbf3 | Triage

Sharing

General

Target

8d9a4898c2f3790ddefdfa470b65bbf3
Size

76KB
MD5

8d9a4898c2f3790ddefdfa470b65bbf3
SHA1

3cf9006fb54aacd8b2c7c998af66730528921daf
SHA256

1321592d5ef729a0d193b94bf27f07c4a9c5a014e6d8920d9ffcec206d45d659
SHA512

d6b8607989ecec5767294e36c689c66b9c8e693ef71475352546c826e042d23f7cf4b5ad2c8c291e7ffaed9c66712cc47dc144a500acd327306e89d38338c38b
SSDEEP

1536:jnIkWf9Ev0lNQJeH+6eNcG1877uZmbRUT2U/3n:bIkk9QJJeeqG1KlUT2In

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d9a4898c2f3790ddefdfa470b65bbf3

Files

8d9a4898c2f3790ddefdfa470b65bbf3
.exe windows:4 windows x86 arch:x86

0e675db83db0ca099230cc012b572aad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CompareStringA
ExitProcess
FatalAppExitA
GetACP
GetCommandLineA
GetModuleHandleA
GetNumberFormatA
GetOEMCP
GetStartupInfoA
GetSystemTimeAsFileTime
HeapAlloc
HeapCreate
HeapReAlloc
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
MultiByteToWideChar
ResetEvent
RtlUnwind
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
WaitForMultipleObjects
lstrcatA

user32

LoadMenuA
PeekMessageA
DialogBoxParamA

winmm

joyGetDevCapsA
joyGetPos
joyGetPosEx
timeEndPeriod

ole32

CoCreateInstance
CoTaskMemFree

advapi32

InitiateSystemShutdownExA
LookupAccountSidW
StartServiceW
QueryServiceStatus
MakeAbsoluteSD
ElfOpenBackupEventLogA
ControlTraceW
AccessCheckByTypeAndAuditAlarmA
ElfReportEventA

shlwapi

PathStripPathA
PathFindFileNameA

shfolder

SHGetFolderPathW

Sections

.text
Size: 63KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ