ba0ee356a7ebb9520c8cdf08d6d49915 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ba0ee356a7ebb9520c8cdf08d6d49915
Size

96KB
MD5

ba0ee356a7ebb9520c8cdf08d6d49915
SHA1

ddc5834092739f57052d807d7d80bcc3e2e654e0
SHA256

73ed89b35c31f05ef607b8d29ac457fe89c826a6628791720518a37e08f55cf7
SHA512

6ff3ddd58552b5784b69c35d2dae953975b6e4a1cf297d20b27899ee39c75e41ea5463350501bd287217ba63666d137e0fc4e4fdc501241c0720a1ed14479a4b
SSDEEP

1536:VGRNRmT8NhU2Pv1NQ/BDfeuKKcGLnv6wrfdWrazPa1PNpeMPgR8l:VGRfC8jxPdNkhNLcGbpj8rOPa1uAXl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba0ee356a7ebb9520c8cdf08d6d49915

Files

ba0ee356a7ebb9520c8cdf08d6d49915
.exe windows:4 windows x86 arch:x86

a26e73e83a5609db4e7dce4b2057fa05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GlobalUnlock
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

strlen
RtlFindLongestRunClear
ZwCreateToken
RtlNewInstanceSecurityObject
RtlReleaseResource
ZwImpersonateAnonymousToken
ZwQueryDirectoryFile
NtCreateKey
NtUnmapViewOfSection
ZwCreateEvent
NtDeleteAtom

Exports

Exports

Wdubltfsr

Sections

.ldata
Size: 4KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_PAGELK
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ