d4db891404858cc065f4d3d1c0f28eb8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d4db891404858cc065f4d3d1c0f28eb8
Size

20KB
MD5

d4db891404858cc065f4d3d1c0f28eb8
SHA1

50c8cb737947e8d92002eac1a359c59a93068de1
SHA256

e8d7274fd672efe116b2e5a3c07bdcf7aba14bdc5b3d84bf997cd1018843712e
SHA512

380054463c2012ee802e94b875b7db92a4ad166433696caaf48659962020c0c4e2a130b598e89108f64d8e0cb909409dc8d0afd8bea55d231710bc57516963a3
SSDEEP

384:5dD26x7/iF1vwvGYq6PiciMdlVjKTOtVhsecbPiEXDIDRulnfWjvOeo:5Q6A4vG6PiciglaOtzsecLiEED8ln

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4db891404858cc065f4d3d1c0f28eb8

Files

d4db891404858cc065f4d3d1c0f28eb8
.exe windows:4 windows x86 arch:x86

bf164a62e8570043cb1cf4fe11fd8f42

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
CreateEventA
WriteFile
SetFilePointer
WaitForSingleObject
lstrlenA
GetModuleFileNameA
LoadLibraryA
lstrcatA
CloseHandle
lstrcpyA
GetTempPathA
GetFileAttributesA
GetModuleHandleA
CreateFileA
GetProcAddress
ExitProcess
ReadFile
SetEvent
OpenProcess
Sleep
GetSystemDirectoryA
ExitThread
GetLastError
CreateMutexA
GetVersionExA
CreateThread
lstrcmpA
ResetEvent
WaitForMultipleObjects
RtlUnwind

user32

SetThreadDesktop
ShowWindow
PeekMessageA
CreateWindowExA
DispatchMessageA
CreateDesktopA
MsgWaitForMultipleObjects
DestroyWindow
CharToOemA
wsprintfA
TranslateMessage

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegNotifyChangeKeyValue
RegOpenKeyA

shell32

SHGetFolderPathA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ