tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

419KB
MD5

b770c18d4f64f4665d29b473bbc410ce
SHA1

c0510c5ce99fbfab1ed36a127bb855fb330cb678
SHA256

cefde96bf6757323d42c59db8b035302a1994012451f3b13ce95246a61c49269
SHA512

fb39d9d224ac9ee35dc17ddf1dfee60737401e9192ef388faa503ffe5e18adf725d97c2a5efb929336d28a22efcf68941f24bd753317f3c73f6a2720835ea4d8
SSDEEP

6144:9pPC0TM5U98IryncaAAVo6bLSSTA1JZBdKfiSqXLlop7yy+Oa482y33fH3OK8Y:fP5T+U98oylAA6sLSSsx7aK33fXn8Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:5 windows x86 arch:x86

d9f469f1b8bd2aefa4cfbc1c006b2f38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
SetUnhandledExceptionFilter
InterlockedIncrement
ReadConsoleOutputAttribute
HeapFree
GetProfileSectionA
SetComputerNameW
SetEvent
GetNumaAvailableMemoryNode
GlobalAlloc
LoadLibraryW
GetFileAttributesA
GetAtomNameW
GetModuleFileNameW
GetLocaleInfoA
SetConsoleTitleA
GetConsoleOutputCP
SetThreadLocale
GetLastError
GetCurrentDirectoryW
GetProcAddress
HeapSize
LoadLibraryA
SetCalendarInfoW
FindAtomA
GlobalFindAtomW
CreatePipe
SetStdHandle
SetFilePointer
CreateFileA
FindNextVolumeMountPointW
FileTimeToDosDateTime
WriteConsoleW
CloseHandle
HeapReAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
HeapCreate
EncodePointer
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
IsProcessorFeaturePresent
LCMapStringW
GetStringTypeW
ReadFile
CreateFileW

user32

GetMonitorInfoW

advapi32

OpenThreadToken
EqualSid

winhttp

WinHttpOpen

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9f469f1b8bd2aefa4cfbc1c006b2f38

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

winhttp

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 269KB - Virtual size: 269KB

.data Size: 10KB - Virtual size: 1.0MB

.rsrc Size: 106KB - Virtual size: 106KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 269KB - Virtual size: 269KB

.data
Size: 10KB - Virtual size: 1.0MB

.rsrc
Size: 106KB - Virtual size: 106KB