aa7c877d4d8899d7fbcb07dc97896bf6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa7c877d4d8899d7fbcb07dc97896bf6
Size

13KB
MD5

aa7c877d4d8899d7fbcb07dc97896bf6
SHA1

453717234c896833855d9a4e0b4cdfecf2eeb0ff
SHA256

3b12791f0c39ccf06808d1734e85620546ae33aaa091d03a0e01a6a610410f1b
SHA512

4fed8f44e743362b5c6fe9163e7dfad08f4a4279ebbf8499ee5812a53051d44a5197b92045d3a008aebe1121052ede7565cc422960fda35ef88c01e294af3242
SSDEEP

384:vMVIDxiyUEMbKyYchbXOX74gfkQqie1Yv:vQoxiyUEMBvhar4UkZiea

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa7c877d4d8899d7fbcb07dc97896bf6

Files

aa7c877d4d8899d7fbcb07dc97896bf6
.exe windows:4 windows x86 arch:x86

e424d0ba4c2848d5e96f1b25c7c80792

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
OpenEventA
SetEvent
Sleep
lstrcatA
DeleteFileA
lstrcpyA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
CloseHandle
FindClose
ResetEvent
SetFileAttributesA
GetFileAttributesA
FindNextFileA
ExitProcess
GetModuleHandleA
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
OpenProcess
CreateFileA
GetTempPathA
Process32First
CompareStringA
TerminateProcess
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery

user32

wsprintfA
CharToOemA
MessageBoxA
ExitWindowsEx
ShowWindow

advapi32

RegDeleteValueA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE