b9672856067e72ef7807654c138a28c3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9672856067e72ef7807654c138a28c3
Size

151KB
MD5

b9672856067e72ef7807654c138a28c3
SHA1

a4804ed17b6a8e219a65f7b21ca9d954d9727411
SHA256

40ca3e9a4195b68d495d982750c3e511ff518acd1a74fc18ae1c48ef177b264e
SHA512

5cdf2f5ecca45298d519c14fba59ea549d811393278041dd81d6a24f15639c1fd88bbad538731f41355571531bdf0f2b1d1d954c5507d8b5df75dea93c373dfc
SSDEEP

3072:RAHtQZzDnx+i2jdbRfkE2KawoZifmaPbCXeyJB3JjEg:KKRjxEz5c4m9ZEg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9672856067e72ef7807654c138a28c3

Files

b9672856067e72ef7807654c138a28c3
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ