a981104ff4a4be7eea187f3027bacf6bb6e9aa7e9200d4a569617720ff47e5dc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a981104ff4a4be7eea187f3027bacf6bb6e9aa7e9200d4a569617720ff47e5dc
Size

94KB
MD5

3d4fa8438f316a4740429c3fa55add8c
SHA1

fcfee44da272e6eb3fc2c071947df1180f1a8ae1
SHA256

a981104ff4a4be7eea187f3027bacf6bb6e9aa7e9200d4a569617720ff47e5dc
SHA512

70446db41cf6cc31d8a954eecf680e3be3605a701582168fb0177c07e2d1d6d0528d396b438cd0a25500e6bacb1e1d095d2dc59155aede8e64e9ee9934e819d1
SSDEEP

1536:bnay94zcAiKVX9ncJ6G/bpaSkK3MmoiJdQLfb:bnx8VXuFDpmcoioLf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a981104ff4a4be7eea187f3027bacf6bb6e9aa7e9200d4a569617720ff47e5dc

Files

a981104ff4a4be7eea187f3027bacf6bb6e9aa7e9200d4a569617720ff47e5dc
.exe windows:5 windows x86 arch:x86

71d9cfb73e1af83948dbd5b5fdd5489b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
GetCurrentProcess
VirtualAlloc
GetModuleFileNameW
lstrlenA
ResumeThread
CreateToolhelp32Snapshot
Sleep
Process32NextW
LockResource
GlobalAlloc
lstrcpyA
WriteProcessMemory
CloseHandle
LoadLibraryW
LoadResource
FindResourceW
GetProcAddress
ExitProcess
ReadProcessMemory
GetCurrentProcessId
GetModuleHandleW
GetTickCount
lstrcmpW
TerminateProcess
Process32FirstW
SizeofResource
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent

advapi32

GetUserNameW

shlwapi

StrStrA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ