aad6cdf6b72e32d68f087e039d24a5d8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aad6cdf6b72e32d68f087e039d24a5d8
Size

801KB
MD5

aad6cdf6b72e32d68f087e039d24a5d8
SHA1

49885133147d582e2cb91c6656c1f477ed2835c5
SHA256

895b395f7f8e4c0e30468258fc8c8032841ef1703bb3e4b0b5bc9075c63e8d4f
SHA512

b7bf6df43cb84ed09d0f3f141149b8d1b616957b9281241bab1fe0f71aa27495ab2807d3523ff676410edc05814058f645036f18a9d4780433ed274fb5d83c29
SSDEEP

12288:Vqt2OzVkU2Wd/NXDGlbjTR6JgXNJisOZjSAy9treLbnPlZdqfwwxUdR/s0sjs70C:stcWdZGh66X/fOZMEF/GwQIsG0srnkPe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aad6cdf6b72e32d68f087e039d24a5d8

Files

aad6cdf6b72e32d68f087e039d24a5d8
.exe windows:4 windows x86 arch:x86

a058c71249b859c9035dcb3040d194bc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
PulseEvent
GetModuleHandleA
lstrcpyA
FindClose
Sleep
GetCurrentThreadId
CloseHandle
GetSystemTime
HeapCreate
CreateFileW
LoadLibraryW
GetCurrentDirectoryA
GlobalUnlock
CreateThread
GetCommandLineA
UnmapViewOfFile
ResetEvent
LocalFree
lstrlenA

user32

GetCaretPos
GetDlgItem
DrawEdge
GetDC
DispatchMessageA
IsWindow
CheckRadioButton
CreateIcon
DrawMenuBar
SetFocus
CallWindowProcA
FillRect
CreateWindowExA

cryptui

WizardFree
LocalEnroll
CryptUIDlgCertMgr
CryptUIDlgSelectStoreA
CryptUIDlgSelectCA

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 794KB - Virtual size: 796KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE