8f69738b7e3cf0f2dc456047c33cbd76 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8f69738b7e3cf0f2dc456047c33cbd76
Size

14KB
MD5

8f69738b7e3cf0f2dc456047c33cbd76
SHA1

602bed3a0a35b05de566a94f6c007160a7581d83
SHA256

6890dbfa09ea18fc4066ba60a0376126cd3759152cfcff5eef0713475748ad73
SHA512

e97942ba9650fcb44cdccd4853263cb7a659fb5269b1c73133fae510959282ebd5209174594b9a7d0e4b0c61fa467bd7dff297cf8a252b60c7b4543ded2bbbe9
SSDEEP

384:tYkmLYKAsJ/bLr4VmGlxlTHHgEz1ylly6:YYc/bv4xlxlTngiyK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f69738b7e3cf0f2dc456047c33cbd76

Files

8f69738b7e3cf0f2dc456047c33cbd76
.exe windows:5 windows x86 arch:x86

c4661c6ce4e43c335e20f9b7d0a9b46b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrA

kernel32

CreateDirectoryA
GetCommandLineA
Process32First
CreateToolhelp32Snapshot
ExitProcess
GetProcAddress
LoadLibraryA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetFileAttributesA
TerminateProcess
Sleep
GetCurrentProcessId
GetLastError
Process32Next
GetStartupInfoA
GetModuleHandleA
HeapFree
GetProcessHeap
HeapAlloc

shell32

ShellExecuteExA

user32

wvsprintfA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE