67843a76ea95609df0f8d7f5dcc8f26d350966f8a32c3d74e95cd515f03caf0a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

67843a76ea95609df0f8d7f5dcc8f26d350966f8a32c3d74e95cd515f03caf0a
Size

839KB
MD5

70319ef9f5cc32533ccdb43fa5a206f3
SHA1

cd7fd5d3a243b8eec2fcf1f342e2bbde32806a83
SHA256

67843a76ea95609df0f8d7f5dcc8f26d350966f8a32c3d74e95cd515f03caf0a
SHA512

8fb1e52df8cf06c0a04bb50fc380d1e1fa4306052675170bca8dde22ecba0f726d85489101f982bacc129b23b72cb3077d8d460b4bf87ea9ffc52eeebcca9168
SSDEEP

12288:Wh3ZukLF5fRY5a/6GX4D1DwhHd1zre/9CL7BfvcyDfvQl:WhMkxlRSaiPDi3qs3RvcVl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67843a76ea95609df0f8d7f5dcc8f26d350966f8a32c3d74e95cd515f03caf0a

Files

67843a76ea95609df0f8d7f5dcc8f26d350966f8a32c3d74e95cd515f03caf0a
.exe windows:4 windows x86 arch:x86

8c8cd2fe8f466202b9cc82f6156dad3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
CloseHandle
Sleep
ReadFile
SetFilePointer
CreateFileA
QueryPerformanceCounter
ExitProcess
GetModuleFileNameA
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
GetStartupInfoA
GetModuleHandleA
HeapReAlloc
GetCommandLineA

user32

wvsprintfA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ropf
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ