8f5bdb8732e39967f0823dbae580879e | Triage

Sharing

General

Target

8f5bdb8732e39967f0823dbae580879e
Size

24KB
MD5

8f5bdb8732e39967f0823dbae580879e
SHA1

7a1da26ababeb2961cbdd191c1eeabfb154d1284
SHA256

187c4fa1dbc95a7d39f054bf686efdae37bcdfc532bb4084342f866bda4abe14
SHA512

e829194d7e23c826c77968b9ea4b86534e3532071e625bd68b391598f43645ec7bd4199513bfcb2c7e93daba944cba959c29293fdd378b00b23a57e928d7114c
SSDEEP

384:NGIFqlemHpsHAqiAgHcHTD6zH6HkJBexHdhv1:NGK1mHpsHxiAgHcHCzH6HkJUTt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f5bdb8732e39967f0823dbae580879e

Files

8f5bdb8732e39967f0823dbae580879e
.exe windows:4 windows x86 arch:x86

be5b81d809afa74da37cddc4d3488c52

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
ReadFile
SetFilePointer
GetTempPathA
lstrcpyA
GetSystemDirectoryA
GetModuleFileNameA
Process32Next
lstrcmpiA
lstrlenA
Process32First
GetProfileIntA
GetCurrentProcess
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenW
OpenProcess
MultiByteToWideChar
CreateFileA
WriteFile
CreateToolhelp32Snapshot
CloseHandle
GetStartupInfoA

user32

wsprintfA

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

ole32

CoCreateGuid

msvcrt

_controlfp
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
strcpy
strlen
strstr
memcpy
__CxxFrameHandler
_EH_prolog
_except_handler3
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE