e039d2c5a885d873ca1907c3693e9515 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e039d2c5a885d873ca1907c3693e9515
Size

154KB
MD5

e039d2c5a885d873ca1907c3693e9515
SHA1

493c3a7bceb7001e600ae56ad6ebe595bae90170
SHA256

ed426fdaa66122548d8331b50c0fac678a73d8b3b2c3bf07a8f69f84bcb6496f
SHA512

dd72bdcba4a3b283b533e95b20fd8cd3449eea9077feb95ae33e236e5de98ff919dabc4933d6aa7d5e6778f57c4daf42ad1e93d2e60c2525f678f2cf72054c1f
SSDEEP

3072:v4dk5knxDfSN1GtDUysnfHn1IBZmxwdg/1ilzxEOLyBbNT9O0W1ZRHrph:0xbByfHW/g/UlyOLyBbNkpRf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e039d2c5a885d873ca1907c3693e9515

Files

e039d2c5a885d873ca1907c3693e9515
.exe windows:4 windows x86 arch:x86

0308f778791c5c98edf6595072b4ea72

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
CreateProcessA
GetModuleFileNameA
GetCurrentProcess
SetThreadContext
ResumeThread
GetThreadContext

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

msvcrt

malloc
fclose
??3@YAXPAX@Z
fread
fseek
fopen
free

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Wpack
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE