e009fe2e05328e354f013c22fe6ad1e0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e009fe2e05328e354f013c22fe6ad1e0
Size

176KB
MD5

e009fe2e05328e354f013c22fe6ad1e0
SHA1

fc46ec88625db8779397d6aab3853bf6e5636a65
SHA256

68434f8ccdd9bda1def321a216b99fb5566414ab60f213acfbd54c0ac0ceb34b
SHA512

a0316aef929a076fca78d77c893afb0252e7f30d6e8fd75b5dcc67a216ee80c30ab169b1aa85f2b5843abf9b7ee03a947d853996b35e65c69841886282c9d1ec
SSDEEP

3072:CskxrUe0VRQb9yq97RUltgNZYyhD3EnCgPRzsrxOuzA3YZHXD:C97+ib9yqZOINZthDEnnPyHIS3D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e009fe2e05328e354f013c22fe6ad1e0

Files

e009fe2e05328e354f013c22fe6ad1e0
.exe windows:4 windows x86 arch:x86

7d296aae98874118b484d64f759303fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameA

kernel32

GetProfileStringW
lstrlenA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 692KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ