970fbe2307a9cbc7071b5db2b7cc2658 | Triage

Sharing

General

Target

970fbe2307a9cbc7071b5db2b7cc2658
Size

96KB
MD5

970fbe2307a9cbc7071b5db2b7cc2658
SHA1

d76ac4907a55256f634371f636a9c5686b2bdf82
SHA256

22b76348416c50dcfe2fc4dbe55e5cddb966d5d8136e89c3328503e30b39a939
SHA512

c7e69ec9621f676dce372a73819ecea63bd46578e51d4a52313765b1d825b1f5e60848154c2a61eb2ac92503f6018d0819fb40ff38d88bc7773fa98add79d670
SSDEEP

1536:lk51y9q1P6dUF9qTyRqFErNsurYIrGfM1ZbeSp5OsdvrfuoTs:l+1y8PsUj2EB0IrGfMPp5OsddY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
970fbe2307a9cbc7071b5db2b7cc2658

Files

970fbe2307a9cbc7071b5db2b7cc2658
.exe windows:4 windows x86 arch:x86

794f720491cfb3bab7d3b7c35e78cd9d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcrt

fread
perror
malloc
fclose
sprintf
free
fopen
strspn
strcspn
fgets
fwrite
getenv
strncmp
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
printf
_iob
fprintf
exit
strchr
strrchr
_exit
_strdup
_stat

kernel32

QueryPerformanceFrequency
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
QueryPerformanceCounter

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lrdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE