8d396e8459ba2ddd6bc1f617d5d0b413 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d396e8459ba2ddd6bc1f617d5d0b413
Size

16KB
MD5

8d396e8459ba2ddd6bc1f617d5d0b413
SHA1

12f761be4d201ae7e2c9ba0597c2c316062ad4b2
SHA256

85c50fb25a89236acf90aae36e6d50f78196b61543b5d962cbfad761d28b06f9
SHA512

0d885f026bb0936cb7b5decc56d71e1ab168f7a8e3bdc8c818fa57597a29e176fcda40db491c80da31e18ee21fe21ffabe699d633df12ac1f9dedc2228ccb3f7
SSDEEP

48:ayB2mCkc9gfugBybWE+VqvesGwAj2e3l8VUNjPtboyl1l7W9j:9BugGgkbWEtvJGwM2e3lRjPtboynw9j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d396e8459ba2ddd6bc1f617d5d0b413

Files

8d396e8459ba2ddd6bc1f617d5d0b413
.exe windows:4 windows x86 arch:x86

e8e5e2d613c0aaf2559e5dff4d75bff9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateEventA
LoadLibraryA
GetTickCount
GetModuleFileNameA
FindResourceA
LoadResource
LockResource
SizeofResource
DeleteFileA
CreateFileA
WriteFile
FreeResource
CloseHandle
GetWindowsDirectoryA
GetModuleHandleA
GetStartupInfoA

advapi32

OpenServiceA
OpenSCManagerA
ChangeServiceConfigA
ControlService
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegOpenKeyA
RegSetValueExA
RegCloseKey

msvcrt

srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
sprintf
rand

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ