033a0abe873eea75c5826e776c3be8edf02063f258fe55774335962e65033a2a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

033a0abe873eea75c5826e776c3be8edf02063f258fe55774335962e65033a2a
Size

167KB
MD5

0c1212779404ed4476c8cdb9692ee534
SHA1

06904071e067250b9f0554474c20b5a77e4af3e6
SHA256

033a0abe873eea75c5826e776c3be8edf02063f258fe55774335962e65033a2a
SHA512

20489fb34292a5c66586ccc18e8c28e50b1ad573832b1e00c8d8ccf1268d925ca798ba6f2a19c56c6675ca72f07b25fa93bf79a3e195788646c62555c6f9d2ac
SSDEEP

3072:ONNsU1qukHFUMMnMMMMMX7I7DjiSAE4Srf2jYnMp4KJDrquyTUFIYQsj+7n7u1uh:WrqdmMMnMMMMMaGSAxC2EwJDrsIxQt7Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
033a0abe873eea75c5826e776c3be8edf02063f258fe55774335962e65033a2a

Files

033a0abe873eea75c5826e776c3be8edf02063f258fe55774335962e65033a2a
.exe windows:5 windows x86 arch:x86

24b272c62bd8c0b0b6ba9f11046ebc16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlAddAccessAllowedObjectAce
NtAllocateVirtualMemory
RtlAdjustPrivilege
NtRequestPort

rtutils

TraceDumpExA

kernel32

GetLastError
FormatMessageW

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE