c8b0865a6c2b42f59022d014141f24b0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8b0865a6c2b42f59022d014141f24b0
Size

6KB
MD5

c8b0865a6c2b42f59022d014141f24b0
SHA1

b2f0de3a43b4f9101fcf55fbd95e1793eefaaf0e
SHA256

d44552b6111cf7eefb6a4700bdadd477552bcb77804526bcb1a414ec03fb0c4f
SHA512

f651a60eff0dda4ed8eaca5e752781f9bc5f0fdafba1ae91d3f93298ad3809e46e5be486227fc70a95038fa4c45098cd8641fbb25c2f20129a8952db8a9341f5
SSDEEP

48:yD6zW4yD5EoC4yO7bDr6u23y9eZPBeYMJqICwQLv3:HW3yvMDl2C6PJr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8b0865a6c2b42f59022d014141f24b0

Files

c8b0865a6c2b42f59022d014141f24b0
.exe windows:4 windows x86 arch:x86

faeb3312c20855d9601b02bf3dd52b8d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetSystemDirectoryA
LoadLibraryA
OpenProcess
Process32First
Process32Next
ReadFile
RtlZeroMemory
SetCurrentDirectoryA
ExitProcess
TerminateProcess
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpiA
lstrcpyA
CreateToolhelp32Snapshot
CreateFileA
SetFilePointer
CloseHandle

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE