de56a8efddef31d92f812bf23e6076f5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de56a8efddef31d92f812bf23e6076f5
Size

28KB
MD5

de56a8efddef31d92f812bf23e6076f5
SHA1

e99d773251e435c11b1b079e0d64138c15bb26be
SHA256

2da15de5f942244e6afd799f97b99de336578ee721e81f14051a62958f932a45
SHA512

ad337ed7ccde8bccb0a647cbb86366e2a22246af2645f7f2115bdefacfbd21e721ead7a8822f86141703a8d13064edd89ab281eb3ca861f6047a73d5a5e84e34
SSDEEP

384:uV7XW4maRzPNprdYrDoOLjI84X1D6qyJw2qWvGtkno0jzqqQubpovTU8vtZYmk+T:WmShprdYrMOfBYDNo7OGoEnQpvTeTs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de56a8efddef31d92f812bf23e6076f5

Files

de56a8efddef31d92f812bf23e6076f5
.exe windows:4 windows x86 arch:x86

010bbe6472a8e30be12d187d90501114

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GlobalUnlock
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

_strlwr
NtUnloadDriver
NtPowerInformation
NtSetInformationProcess
isdigit
ZwReadRequestData
_ltoa
islower
ZwSetContextThread
ZwSetVolumeInformationFile
RtlAllocateHeap
RtlRealPredecessor
NtCompleteConnectPort
ZwQueryOpenSubKeys
LdrGetDllHandle
RtlEqualDomainName
RtlCopySecurityDescriptor

Sections

.gdata
Size: 4KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_PAGELK
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ