9b0fcc0c120982b0e8aa654618230d3e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9b0fcc0c120982b0e8aa654618230d3e
Size

8KB
MD5

9b0fcc0c120982b0e8aa654618230d3e
SHA1

55e44967d00687626dde9bc9491d9a0d271b6b43
SHA256

143a41d537d6434a5bee0a8fb72cac3cc8f41c946c379343f76e2c06ff21e8c4
SHA512

6c67cfdd5fa82a3dd628b1e35cabcbbf1e764fc6febbea448fa32b40a4f52b1992823901c9d6dc856ddba50a38251a42058a307c5173889fa3f93d3f682e5da4
SSDEEP

96:TIoDx+7hyraMa591lUnGZnAjUfo5C/e2IMKDU13AMAV+M2YutjuxOSII0DNchyQe:TftUhfVZHfN/UMKo8o2OS+NcT97Gl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b0fcc0c120982b0e8aa654618230d3e

Files

9b0fcc0c120982b0e8aa654618230d3e
.exe windows:6 windows x86 arch:x86

ec86c9c92062e8b93e614dd1f7d6191f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\programs\siberia2\umloader\objfre_wxp_x86\i386\UMLoader.pdb

Imports

advapi32

RegSetValueExA
RegOpenKeyExA
RegCloseKey

kernel32

HeapAlloc
GetProcessHeap
ExitProcess
CreateProcessA
GetEnvironmentVariableA
lstrcatA
GetShortPathNameA
lstrlenA
lstrcpyA
GetCommandLineA
CloseHandle
WriteFile
CreateFileA
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
ReadFile
GetFileSize
GlobalAlloc
Sleep
CreateThread
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

shlwapi

PathFindFileNameA

ntdll

strlen

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ