dfaaa1d690ce584176522afbc448bb1a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dfaaa1d690ce584176522afbc448bb1a
Size

8KB
MD5

dfaaa1d690ce584176522afbc448bb1a
SHA1

a4b284aebb9f58506e41ed7dff55062cc53eee53
SHA256

3d25c40c9cfed52b85879a869569976d0875ad4cbe1096db20a970499ad5faaf
SHA512

2cf99ae471b70a1cd997b8b99d1e2b61cfe34673fd5cf024309e2dde1b5997fb67ff967955b66f6b84452c731f687ab29bf002ff34b4bcaee44b8d7082833862
SSDEEP

192:RNUIS/BHZins/aETD1NWh3b2fCBucAlNU4+BW7lm:oIS55J/TTjWhL2aBMle4oW7l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfaaa1d690ce584176522afbc448bb1a

Files

dfaaa1d690ce584176522afbc448bb1a
.exe windows:4 windows x86 arch:x86

ff00b01eec733ab02fc33cf506d4aa5c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetCurrentThreadId
GetTickCount
GetTempPathA
CreateThread
lstrcpyA
GetPrivateProfileStringA
CopyFileA
CreateDirectoryA
GetDriveTypeA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
VirtualProtectEx
GetCurrentProcess
GetLastError
CreateMutexA
GetCommandLineA
DeleteFileA
LoadLibraryA
GetProcAddress
Sleep
GetVolumeInformationA
lstrcatA
lstrlenA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

msvcrt

fopen
_ftol
sprintf
malloc
strstr
_strlwr
fclose

Sections

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE