e1b083dc3381f2b60bb5cd62c6a3219d | Triage

Sharing

General

Target

e1b083dc3381f2b60bb5cd62c6a3219d
Size

84KB
MD5

e1b083dc3381f2b60bb5cd62c6a3219d
SHA1

ea10c1f46701eed560a18d589b5f0b6ceb6e73c0
SHA256

2852fce06c8f4c0e7371776a64a1a58504dd48de7ab18a1b70b71793c4be0812
SHA512

1a3d9736e66e6a49212dd323fa7488f46cff22c1f83c60231487a73a4e875922ec6c10b6b3b802d56b17fe858f675821cb96ce4dd8803db1914861bf35425ecf
SSDEEP

768:mDCS7U9CYjixi3L9CMCtKPMpZXYVqkAuUb+hjGN/Cezx/ha5U:mDCOUzki3SBpZXYVqkVjjIH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1b083dc3381f2b60bb5cd62c6a3219d

Files

e1b083dc3381f2b60bb5cd62c6a3219d
.exe windows:4 windows x86 arch:x86

c19f444e32944a310a2a2745ef3f3371

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_initterm
memset
strcat
strstr
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
strcpy
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strcmp
sprintf
memcpy

kernel32

CloseHandle
WriteFile
lstrlenA
WinExec
CreateFileA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetModuleFileNameA
GetLastError
CreateThread
CopyFileA
GetVersionExA
GetVolumeInformationA
LocalAlloc
GetCurrentProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
FreeLibrary
lstrcmpiA
LoadLibraryA
GetStartupInfoA
Sleep
lstrcpyA

user32

FindWindowExA
CharUpperA
PostMessageA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
QueryServiceConfigA
ChangeServiceConfigA
StartServiceA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegCloseKey
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus

Sections

.Upack
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE