b9e848e94a49cb3e3b3b007de86d39ba | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9e848e94a49cb3e3b3b007de86d39ba
Size

7KB
MD5

b9e848e94a49cb3e3b3b007de86d39ba
SHA1

7b0042acd3474532afb56687fa8e4571d8d47c04
SHA256

7d1036b8f0bbd0621afa822b41e4c93cad295f59f3f306bf4467cb380a83ff0a
SHA512

a294f50b5d0ceb4652201411156c501aedf1a245b9c01f61c27f7f09cccdf25a9451e21cc2cc5fab3ede53958879cf67ec1e5ff3f09e5d2a050cabce8639efbe
SSDEEP

48:iEAhkUu7dEOpiVv1gHMCAUCiJNf9PcTomr1THj2TPtboyl1I2M0UVx/lovtxjfm:RA67iSgEAUwTYPtboyna2xjf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9e848e94a49cb3e3b3b007de86d39ba

Files

b9e848e94a49cb3e3b3b007de86d39ba
.exe windows:4 windows x86 arch:x86

a8f642390bac01f3cf1c57739c1ced10

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetCurrentProcess
CreateRemoteThread
GetProcAddress
Process32First
WriteProcessMemory
VirtualAllocEx
lstrlenA
OpenProcess
Process32Next
GetSystemDirectoryA
GetModuleHandleA
Sleep
GetStartupInfoA

msvcrt

_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
fopen
fwrite
fclose
exit

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 958B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE