6a9a54fff6a5a6bec907de6781fd7af4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a9a54fff6a5a6bec907de6781fd7af4
Size

212KB
MD5

6a9a54fff6a5a6bec907de6781fd7af4
SHA1

efe16674d942296a02553e796f7740fb8c63c5ac
SHA256

67ee8ac68d5b1a741170701cf4fcfc4887db7eb29e1fe83d5b3126e37e67254b
SHA512

a0c05c0309b88a369d9596ddd9125936127addaabc64b79259379808237babe036746d4092b0448875a816073d9e060e05bc0930b4a60737fe556eb047af5046
SSDEEP

6144:5gCtYTroR4/RUNWca+pOXOI2D4tC3lVWErD5O:t+0R4Wa+puON42D5O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a9a54fff6a5a6bec907de6781fd7af4

Files

6a9a54fff6a5a6bec907de6781fd7af4
.exe windows:5 windows x86 arch:x86

ec7bb662d9136e46969a83e1a48c94c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\PMS\pms4\Project(20131004)\HanCapture\bin\Release\Agent.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageTime

gdi32

SetViewportExtEx

advapi32

AdjustTokenPrivileges

shell32

ShellExecuteW

ws2_32

WSAStartup

oleacc

LresultFromObject

winspool.drv

DocumentPropertiesW

oleaut32

VariantClear

Sections

.text
Size: 206KB - Virtual size: 692KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE