a39eb24c9994249687cf515cbc579742 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a39eb24c9994249687cf515cbc579742
Size

130KB
MD5

a39eb24c9994249687cf515cbc579742
SHA1

dcad7346f32d77d88e06ff2d894be00b47d3eaf5
SHA256

bbf0f26ee39c57b5b1149f9c489de735e26ace06858463127fd4accd245a8f04
SHA512

8d19adb1263eb2ac0853a7d868e03dabc7a7206729230fc69fa07994627b8ce1062d31d356a66ca042982542f629e919aba9d0352a54aeedab328dea4ee47e2c
SSDEEP

3072:iQfCUWh3Obpj6fUXTJXkNApgSKrq4IPqAOt:PCUWkb9JmCpgS0q4IPFO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a39eb24c9994249687cf515cbc579742

Files

a39eb24c9994249687cf515cbc579742
.exe windows:4 windows x86 arch:x86

52981dd17c7dbe54e1d401dc671a9e7e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExW
FreeConsole
IsBadReadPtr
GetLastError
CloseHandle
GetDriveTypeW
DeleteCriticalSection
CancelIo
GetDateFormatA
LocalFree
SetLastError
ResetEvent
GetDiskFreeSpaceExA
FindClose
TlsGetValue
GetModuleHandleA
VirtualProtect
IsBadStringPtrA
EnumResourceTypesW
GetCommandLineA

advapi32

CloseTrace
IsTokenUntrusted
LsaFreeMemory
GetLengthSid
RegEnumKeyExA
RegCreateKeyExA
RegCloseKey
LsaClose
CloseEventLog
OpenEventLogA
AccessCheck
FreeSid
GetFileSecurityW
RegCloseKey

hnetcfg

DllGetClassObject
HNetFreeSharingServicesPage
HNetGetSharingServicesPage
HNetDeleteRasConnection
DllRegisterServer

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ