8afb237a01345a3dd25c2955e0372581 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8afb237a01345a3dd25c2955e0372581
Size

187KB
MD5

8afb237a01345a3dd25c2955e0372581
SHA1

5c57e961b314f11680c17e4d251f70584cc12f76
SHA256

59a3863adc5f13b06ff0cfa0f582ece3817789a5064b0947003de075d49420f5
SHA512

a91389fd3fa96742352836877ec3721af871dfa2d91b244cac030e2be637f4dacef09827b51c112404eaf6f0dd9fa234cb7ecee2b8db6ea2e11a6c2a963bb1fc
SSDEEP

3072:/VL6QpFhrhOrnfTcYuZL6SyZSbMr+oLVuj8nykJZTuYu4lECugNP9:56QpFhIfWuSyss+k3PuM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8afb237a01345a3dd25c2955e0372581

Files

8afb237a01345a3dd25c2955e0372581
.exe windows:4 windows x86 arch:x86

044138c3bcc77426221e5345852a958a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetModuleFileNameA
GetModuleHandleA
ExitProcess
WinExec
CreateDirectoryA
Sleep
GetLastError
DeviceIoControl
MoveFileA
GetWindowsDirectoryA
LoadResource
FreeLibrary
GetProcAddress
LoadLibraryA
CopyFileA
lstrcatW
GetWindowsDirectoryW
GetVersionExA
GlobalFree
LoadLibraryExA
GlobalAlloc
LockResource
GetSystemDirectoryA
CreateFileA
SizeofResource
WriteFile
CloseHandle
DeleteFileA
FreeResource

advapi32

OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegOpenKeyExA
RegSetValueExA
ControlService

shell32

ShellExecuteA

msvcrt

fopen
fclose
fprintf

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ