9bad988992c6a620ecebca0306d919f1 | Triage

Sharing

General

Target

9bad988992c6a620ecebca0306d919f1
Size

128KB
MD5

9bad988992c6a620ecebca0306d919f1
SHA1

a83c5834119f3363ceec3428d6b98a2f90bfa94e
SHA256

53a94c066d95f2ab36078ad12c3d1419fb548878ff2515776931233059207079
SHA512

fd350df536e41b06dc23dbf078af2e96350b5d188fecdcfccdec72b1a4d271b75af22961aafa8d23502bae5ea7404ae326970f9c10005e67d419081740e14363
SSDEEP

3072:fhZaD4ZCaeEFcx1mphxQqWeyN3aspCcirNWF1MgXpv1QbQX9QGQ:fhZaD4ZCaeEFcx1mphxQqWeyN3aspCc2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bad988992c6a620ecebca0306d919f1

Files

9bad988992c6a620ecebca0306d919f1
.exe windows:4 windows x86 arch:x86

581bb6dc7a4137dd70c090e8f59446b7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
exit
longjmp
_exit
sprintf

kernel32

FreeLibrary
InterlockedExchange
Sleep
LocalAlloc
LocalFree
LoadLibraryA
GetProcAddress
GetLastError
GetModuleHandleA
GetCommandLineA

user32

CharUpperA
MessageBoxA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

_mFdllinfo

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE