bf9db04ad7d390e746b395c0740ca139 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf9db04ad7d390e746b395c0740ca139
Size

21KB
MD5

bf9db04ad7d390e746b395c0740ca139
SHA1

904fa6fac12f41a756c8a8f0b5e6ef2f7842a3da
SHA256

db8b3bfbf712088d6004c307e70057bc09ce29509ed06c9db4e06ea1fce42c48
SHA512

009ec90f3853c8251cfef1d8d516544a337f3e41de03bf6422dcf16c49b1bd8b6ee184fb6dc04f19a1a369f693484540cc130f3d76874e0005e5c24f450127d0
SSDEEP

384:bwQYG1+yS3l3TpWSnoX+MCK8rbj+7+g6RfyB0M1oyIg:bwlG1+73dTpHnoOm8i7ERfrM1oyIg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf9db04ad7d390e746b395c0740ca139

Files

bf9db04ad7d390e746b395c0740ca139
.exe windows:4 windows x86 arch:x86

2e496e9c1a6369ba2b6ea57c8c93b74b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
CloseHandle
WriteFile
CreateFileA
GetTempPathA
GetModuleFileNameA
SetFilePointer
ReadFile
WriteProcessMemory
GetSystemDirectoryA
OpenSemaphoreA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetVersionExA
Sleep
GetLocalTime
GetFileSize
RtlUnwind
LCMapStringW
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA

user32

wsprintfA

advapi32

RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE