c9390be9101cdaccc3cc3e029ec5efe8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c9390be9101cdaccc3cc3e029ec5efe8
Size

59KB
MD5

c9390be9101cdaccc3cc3e029ec5efe8
SHA1

d1cccc9ea92d73ffd3025b7b985f0c6b811825ff
SHA256

da4f7b3bcf359ec63d9a387bf07b71d8fdf9f77f336e3ba0796b8ee0b79e2207
SHA512

9f12612a38527c970d6518ec00187ca7fc0cda82eab9913e6caf6ab3dc9ea6d0f584dc6de3c435ed816f9c2b08870d8c749d9dbf6c45914d15b4e4b9cbbd820a
SSDEEP

1536:K2EMp8S7AkdGdRaY1L+nKaJc2xBnNeJwqrj:KExdaR+KaRnNTqP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9390be9101cdaccc3cc3e029ec5efe8

Files

c9390be9101cdaccc3cc3e029ec5efe8
.exe windows:4 windows x86 arch:x86

7f807bb781d7a01ab54f89f6181d14c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptHashData
RegSetValueExA
CryptDestroyHash
CryptCreateHash
RegEnumKeyExA
CryptReleaseContext
GetUserNameW
CryptAcquireContextW
RegQueryValueExA

shlwapi

PathFindFileNameW
PathMatchSpecW
PathCombineW
wvnsprintfW
StrCmpNIA
StrStrW
StrCmpNIW
SHDeleteKeyA
PathFileExistsW
wnsprintfA

user32

GetIconInfo
CharLowerBuffA
FindWindowExA
OpenDesktopA
GetKeyboardState
MsgWaitForMultipleObjects
GetForegroundWindow
LoadCursorA
GetDlgItem
ExitWindowsEx
GetMessageA
DrawIcon
GetClassNameA
OpenWindowStationA
GetKeyState

kernel32

FindClose
VirtualAlloc
VirtualProtect
WideCharToMultiByte
lstrcpyA
MultiByteToWideChar
GetVersionExW
SetFileTime
lstrlenW
lstrcatA
GetFileAttributesW
lstrcmpiW
lstrcpynW
Sleep
GetModuleFileNameW
CreateThread
FindResourceW
CreateEventW
LeaveCriticalSection
lstrcatW

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE