b9af30358a4fed51c961eb6621f813a5a9cf6bbc648318eb49745b1869350162 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9af30358a4fed51c961eb6621f813a5a9cf6bbc648318eb49745b1869350162
Size

5.5MB
MD5

d5a309e246e27749d692c0f86d285f00
SHA1

c135e3dbb96b24da0e1dfe33b4702276c4defb92
SHA256

b9af30358a4fed51c961eb6621f813a5a9cf6bbc648318eb49745b1869350162
SHA512

4f2d2113edd15883cf2eecc20e53b0278801cb27804314a7cb63333440eea150e4e02974d43c0b6f5bab5c1f4727a3ad76fd83c1dca60fd1c10443d85c01622e
SSDEEP

98304:FVFBCPq+cIrkNV85kyV4YaDInz2Jsi1VtAIDYR0aWYBwU+dd:FVzCPbko5kysVtVDYRscwUId

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9af30358a4fed51c961eb6621f813a5a9cf6bbc648318eb49745b1869350162

Files

b9af30358a4fed51c961eb6621f813a5a9cf6bbc648318eb49745b1869350162
.exe windows:5 windows x86 arch:x86

9c3599af18d997d40cd8c94bec1ea828

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MessageBoxA
CharUpperBuffW

advapi32

RegSetValueExA

Sections

.text
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.*e-
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hoAiXT
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ

.htext
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dq}
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.E^)
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.;Xa
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ