9b2386cbc1777bb64ab023c953ffda21 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9b2386cbc1777bb64ab023c953ffda21
Size

656KB
MD5

9b2386cbc1777bb64ab023c953ffda21
SHA1

c968ef994b7c8c140645b465914658a7c6e9aa3a
SHA256

e747045d1dae9a9a16df94b2b75ce8b4e862930504e397d4bc215738c293ec0c
SHA512

6777fd0f65da6e8bccb510ac8fb4638fbdf542c9942ad89d09ebd3946d0d52970af03b29d68b4f2587e68bea9ee73fd5340259b8e432fd54609f161151744f3e
SSDEEP

12288:LK1uzsj4jt6eNCkrt/KmRnAwyQU3oo8VW049DkwxJhvTcaWIwzgU/:AEsTjkrdKAAHq25JVcaWIq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b2386cbc1777bb64ab023c953ffda21

Files

9b2386cbc1777bb64ab023c953ffda21
.exe windows:4 windows x86 arch:x86

ef160c440511f58d91c5e60ce83fedc6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rtutils

TraceDumpExA

kernel32

FormatMessageW
GetLastError

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

ntdll

NtAllocateVirtualMemory
RtlAdjustPrivilege
NtReplyPort
RtlAddAccessAllowedObjectAce

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 608KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE