8bcd00065051799b384cf1f7042bf138 | Triage

Sharing

General

Target

8bcd00065051799b384cf1f7042bf138
Size

330KB
MD5

8bcd00065051799b384cf1f7042bf138
SHA1

1ba45a3aa56881c28803ce926dc2d1248d0d5089
SHA256

3f75a7549daebbd73c7d52e5520f83723b77a12ab1e2217853da30a8d0d12438
SHA512

663808c81b670badec0d5adef0569869b0f942695876353eb0bbb9e1580c19273e44fc930adfa5859b7339bbe3ea1958ada7f2a10fdfe9a1915e0dabdbf0cace
SSDEEP

6144:N/g/J/hQk2vz3/eE1/xBClfW20owuecJEo2Nmk5tG675TUGNPwEUw+Vvr41jLHeE:N/g/J/hhlENvQuFoZem2NmkbG675TUG+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

8bcd00065051799b384cf1f7042bf138

Files

8bcd00065051799b384cf1f7042bf138
.exe windows:4 windows x86 arch:x86

52aa528fdbef4817c08d91a5f8e7c4d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
EnumResourceTypesW
GetCommandLineA
GetModuleHandleA
CloseHandle
GetDiskFreeSpaceExA
TlsGetValue
GetLogicalDrives
IsBadReadPtr
IsBadStringPtrA
SetLocalTime
CancelIo
VirtualProtect
Heap32First
FreeConsole
ResetEvent
GetLastError
FindClose
LoadLibraryExW
LocalFree

advapi32

RegDeleteKeyA
GetLengthSid
RegCreateKeyExA
IsTokenUntrusted
CloseEventLog
RegEnumValueA
LsaClose
FreeSid
RegCloseKey
RegEnumKeyExA
RegQueryValueA
GetFileSecurityW
LsaFreeMemory
RegCloseKey

hnetcfg

HNetGetSharingServicesPage
DllGetClassObject
HNetDeleteRasConnection
HNetFreeSharingServicesPage
DllRegisterServer

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ