defdab8f979862abe53197fc00f613ff | Triage

Sharing

Copy URL Twitter E-mail

General

Target

defdab8f979862abe53197fc00f613ff
Size

149KB
MD5

defdab8f979862abe53197fc00f613ff
SHA1

6dacd6aafbfbee080b3cf7bf1c7823f85b5666c5
SHA256

bc37bc5a5779582a254b74a3aa905e9bb9c99719971527cc8a2af3ede3f20406
SHA512

109597379be2f390a9f3d16e1d49b1114620d361031c1634804b6462d11f59196e7b6756f039a37a059b3b363c37f9c463917849894257bc613faab57c205ff3
SSDEEP

3072:3dNdFz2kRR1Lz1U5gfkYVCWq/dcUaITX0LXNYw:37bzjR1LhUikYjqOUaI7AXNY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
defdab8f979862abe53197fc00f613ff

Files

defdab8f979862abe53197fc00f613ff
.exe windows:6 windows x86 arch:x86

ab0777d4ca64edca942860eb01b6b628

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\programs\futuregeneration\startdrv3\objfre_wxp_x86\i386\StartDrv3.pdb

Imports

advapi32

CloseServiceHandle
StartServiceW
CreateServiceW
OpenServiceW
OpenSCManagerA
RegCloseKey
RegSetValueW
RegCreateKeyW

kernel32

HeapAlloc
GetProcessHeap
HeapFree
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceW
CloseHandle
WriteFile
CreateFileW
ExitProcess
CreateProcessW
GetEnvironmentVariableW
lstrcatW
GetShortPathNameW
lstrlenW
lstrcpyW
GetCommandLineW
QueryPerformanceCounter
GetLastError
DeviceIoControl
CreateFileA
GetVersionExW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ