964a6f8ea09c348bb199a163ce0678ed | Triage

Sharing

General

Target

964a6f8ea09c348bb199a163ce0678ed
Size

341KB
MD5

964a6f8ea09c348bb199a163ce0678ed
SHA1

1eafecf7a05136baef403003045ef3d4dad4dc32
SHA256

5331402e558b0aa4e96c7b3af9985808e2f4a68d809a65c94c4d9b952da725b8
SHA512

efb5a391eb869be48736334cd2c43d6c2d2eff6ac871aec6a7541965ca813edfa7978eeb8c24cd5d168db434d33207822b0d193ce53bdf3d0b7e3b49cd42059a
SSDEEP

6144:8NJDLr55iJS+3cBms489NwP5NzmtVEc3wLHHwDpHmiwvRV:E/55iJncBmsT9MNOVEc3wM9miwr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
964a6f8ea09c348bb199a163ce0678ed

Files

964a6f8ea09c348bb199a163ce0678ed
.exe windows:4 windows x86 arch:x86

1f8f9943c68ef4a5655bf1469b9f0b03

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AddAtomA
TlsGetValue
lstrcmpiA
CloseHandle
HeapSize
GetTempPathA
GetStartupInfoA
ResumeThread
GetTickCount
HeapDestroy
SearchPathA
CreateHardLinkA
GetLastError
VirtualProtect
DeleteCriticalSection
SetEvent
ExitProcess
ReleaseMutex
GetModuleHandleA
GetThreadLocale
GetDriveTypeA

advapi32

LsaClose
LsaFreeMemory
IsValidSid
OpenEventLogA
LsaSetSecret
RegEnumKeyExA
RegCloseKey
RegLoadKeyA
GetFileSecurityA
CloseEventLog
AccessCheck
FreeSid
RegCreateKeyExA
RegEnumValueA
CloseTrace

urlmon

CoInstall
CoInternetGetSession
CoInternetParseUrl
HlinkGoBack
CoInternetCompareUrl

gptext

DllRegisterServer

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ