cd8a5090bbde09a809e103164853699a

General

Target

cd8a5090bbde09a809e103164853699a
Size

1.1MB
MD5

cd8a5090bbde09a809e103164853699a
SHA1

86e72421f95fc16c61807dbd122339a1c3664207
SHA256

e23db1a9a065ac1eda6b7c27da379a9564e978b24940e38fc5e7cbd9afc9aa97
SHA512

969c732169aa8871cbb8452d89221003fdba2215c8cc570d14239ea1b445b3fdcbfa562ebe8cb3e206a4ee7f2139ef8a755282ff2f49ac0aa33869df1d2a4a73
SSDEEP

6144:1IxOGqAH9nmrKitPUMfgw8bq2ip5G9a5rd:iOG/MrftPpfr8+nqot

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd8a5090bbde09a809e103164853699a

Files

cd8a5090bbde09a809e103164853699a
.exe windows:6 windows x86 arch:x86

fd6a8eb34f9a54b6823817b119fa8a88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Elevated_MpMiniSigStub.pdb

Imports

kernel32

GetSystemDirectoryW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateProcessW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
GetProcAddress
WaitForSingleObject
GetExitCodeProcess
ExitProcess
GetLastError
CloseHandle
TerminateProcess
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
WriteFile
CreateFileW
SetFileAttributesW
DeleteFileW
HeapFree
CreateDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
EnumResourceNamesW

ntdll

memset
memcpy
DbgPrint

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd6a8eb34f9a54b6823817b119fa8a88

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ntdll

advapi32

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 804B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 512B - Virtual size: 304B

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 804B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 512B - Virtual size: 304B