ad297f1a68b5e93d19d83a3395b5199e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad297f1a68b5e93d19d83a3395b5199e
Size

382KB
MD5

ad297f1a68b5e93d19d83a3395b5199e
SHA1

c9ec2624fbdd2c9411664328ab194dc8ca07dbf3
SHA256

05ab960efa4e9dc7910d53186ea7c86ba1643a3072a08e0d7b70cf080b46c7e2
SHA512

d56f74d05322311de81cf7f90e0f04d6895f369d9773df2f790452f13c81e63aaffa6ee386a5c979af9fb995c64bd8d0dea645937d235d9cb98e0e4e3c55297c
SSDEEP

6144:D1be3ZRM1I8mJ+ehSemWfSZSzuhgrE9dYCb8xf4I7GVltNyEe6EofQKKfnGIYt3L:RGZRM1I8mJlmWp6hgricAQG3Xxai5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad297f1a68b5e93d19d83a3395b5199e

Files

ad297f1a68b5e93d19d83a3395b5199e
.exe windows:4 windows x86 arch:x86

e75263a13cac4e956b7ff156b9781407

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntW
GetEnvironmentVariableW
ResumeThread
VirtualAlloc
GetCommandLineA
InterlockedExchange
LocalFree
GlobalSize
lstrlenA
GetExitCodeProcess
GlobalFree
GetACP
GetModuleHandleW
GetStdHandle
ResetEvent
WriteFile
FindVolumeClose
CreateMutexA
CreateEventA
CloseHandle

advapi32

IsValidSecurityDescriptor
ClearEventLogW
RegCreateKeyExW
CreateServiceA
IsValidSid
CloseEventLog
ControlService
RegQueryValueW
IsTextUnicode
RegEnumKeyW
RegDeleteValueA
RegCloseKey
RegDeleteKeyA

asycfilt

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

hdwwiz.cpl

InstallNewDevice

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ