9b64c1504e96a9eaaf064c1f2e3d5b7b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9b64c1504e96a9eaaf064c1f2e3d5b7b
Size

12KB
MD5

9b64c1504e96a9eaaf064c1f2e3d5b7b
SHA1

cd58e21bf372168a59d40dbd7fbc99cd3c754105
SHA256

2cbda8648e632b412a5a4b1420ee6a28bdb0d48b946e2c3c00f420bfc9d88963
SHA512

6201341e923648f48d30f36b0ec81e4a0e4666d17855b517737f84e2fdc4f42a3dcda263ae78302c77b507a421a0c0caf173b40e51424d900411e8045fa0748d
SSDEEP

192:NNSBlXkBdV7MgyKFnXl363i5VrCmmxlyg+0Q6cfE2mfP1oy:NWSdV7MHu5VG7xR+0Q6cfGn1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b64c1504e96a9eaaf064c1f2e3d5b7b

Files

9b64c1504e96a9eaaf064c1f2e3d5b7b
.exe windows:4 windows x86 arch:x86

85b62e41a67062c9c05487d4180554c7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
LoadLibraryA
GetProcAddress
lstrcatA
lstrcpyA
CreateProcessA
GetVolumeInformationA
GetTempFileNameA
Sleep
GetModuleFileNameA
GetTempPathA
GetTickCount
ExitProcess
CreateThread
GetLastError
CreateFileMappingA
SetErrorMode
DeleteFileA
GetModuleHandleA
GetStartupInfoA

msvcrt

toupper
strstr
malloc
_except_handler3
fclose
ftell
fseek
fopen
fwrite
atoi
fread
memset
strlen
abs
strcat
rand
strcpy
strrchr
strcmp
strtok
srand
__p___argv
__p___argc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
sprintf
fputs
_strdup
_strcmpi

Sections

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE