c940105fcc237578b1cc0964b76d8907 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c940105fcc237578b1cc0964b76d8907
Size

116KB
MD5

c940105fcc237578b1cc0964b76d8907
SHA1

7cdd118c00a082253174136d14fe378045d4f0b4
SHA256

4d1e23579a886baa68a6de0f9dedef05e60fbbb31525bbdf49040ce5288d537f
SHA512

4595597af28a3e404a84159479db0be545c2a8b788c3511ed40e6e6c498e6f56a56a1c8954787729134ac6c1622f530c03aae6755629a7c3cd65870efefc72d2
SSDEEP

1536:2kR75wWTHL7nohFiFyjQLv9zRRsuXaP6VzuVcc9axoHsMK/5l/f3UfzLjp4O9mmf:tLrjmjOvD2uGizumcaMKBl/Ih9h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c940105fcc237578b1cc0964b76d8907

Files

c940105fcc237578b1cc0964b76d8907
.exe windows:4 windows x86 arch:x86

979e4f637a785fe46cf60ae3292704e6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
lstrlenA
WinExec
MultiByteToWideChar
GetVersionExA
GetCurrentThreadId
GetModuleHandleA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA

netapi32

NetLocalGroupAddMembers
NetUserAdd

msvcrt

_exit
_XcptFilter
exit
wcscpy
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
malloc
??2@YAPAXI@Z
rand
_acmdln

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ