f98dae5762cc408fb82f9225094309a36555998165263c0019e1bde76b63a9d8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f98dae5762cc408fb82f9225094309a36555998165263c0019e1bde76b63a9d8
Size

404KB
MD5

dce4aae28d24b3e226d528ce9b917a03
SHA1

68812714a3e446ac21f4db89630ecc80bed42e11
SHA256

f98dae5762cc408fb82f9225094309a36555998165263c0019e1bde76b63a9d8
SHA512

fd8900744499f35c57622a265e82c26e5eee4549417ed2c10cf9b1e5e4242209a3a3972c3ed2e381f381db3ccdf744ba7e3aaadbfd00ff563a060d58c4a2e81a
SSDEEP

6144:r3Tfgh+JXi/50gobJnOwv/z+MdBVStzQdtmY19iyBz5jHbFDJN0gVQBnlmqPoBkN:rjfoMXG5cpF8e9Ftlf1Mmqsk6SAS5ll

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f98dae5762cc408fb82f9225094309a36555998165263c0019e1bde76b63a9d8

Files

f98dae5762cc408fb82f9225094309a36555998165263c0019e1bde76b63a9d8
.exe windows:4 windows x86 arch:x86

8c8cd2fe8f466202b9cc82f6156dad3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
CloseHandle
Sleep
ReadFile
SetFilePointer
CreateFileA
QueryPerformanceCounter
ExitProcess
GetModuleFileNameA
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
GetStartupInfoA
GetModuleHandleA
HeapReAlloc
GetCommandLineA

user32

wvsprintfA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE