tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

600KB
MD5

64486e120b7e59dc162b678e84fbea7f
SHA1

c389480e17a1bad6340e4a61e28a2463531c6a44
SHA256

6e033583e209055891052e486fc5033e85e5fda28796213a02d8b95c10034e64
SHA512

6a5697f6869940f466bd1e82c3d492d4569641a5b5b8a7d5b0c819c7de8d0a2eda9476f795908be6e112e667385aeeeed6c4807c2c844a66102378280522cead
SSDEEP

12288:6DYOZyGODsEDC3yOLDM2y/d9O8BN1FYDHOg5uG134RyEK1bftaV+:1hDVDxOLDdy/dlpFx6uG134RyEK1bft

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

tmp

resource
tmp

Files

tmp
.exe windows:4 windows x86 arch:x86

0a65a403e1c7c25c9489ec735770ea39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

ExitProcess
GlobalAlloc
GlobalFlags
WriteConsoleW
GetFileAttributesW
LCMapStringEx
Process32First
RegOpenKeyExA
SetSystemTimeAdjustment
SetTapePosition
lstrcatA

d3dcompiler_47

D3DCompressShaders
D3DCreateBlob
D3DGetBlobPart
D3DGetInputAndOutputSignatureBlob
D3DLoadModule
D3DReadFileToBlob
D3DSetBlobPart
D3DStripShader

evr

DllRegisterServer
DllUnregisterServer
MFCopyImage
MFCreateDXSurfaceBuffer
MFCreateVideoMediaType
MFGetUncompressedVideoFormat
MFInitVideoFormat_RGB

imagehlp

ImageGetDigestStream
MapDebugInformation
SymEnumerateSymbols
SymFindFileInPath
SymGetSourceFileTokenW
SymGetSymFromName
SymGetSymNext64
UpdateDebugInfoFileEx

mpr

WNetCancelConnection2W
WNetCancelConnectionA
WNetConnectionDialog
WNetDisconnectDialog
WNetGetLastErrorW
WNetGetResourceParentW
WNetGetUniversalNameA
WNetSetLastErrorA

mscms

CheckBitmapBits
CheckColors
GetCMMInfo
GetColorDirectoryW
GetColorProfileElementTag
OpenColorProfileW
SetStandardColorSpaceProfileW
TranslateBitmapBits
WcsEnumColorProfiles

oleacc

AccessibleObjectFromEvent
AccessibleObjectFromPoint
AccessibleObjectFromWindow
CreateStdAccessibleObject
GetOleaccVersionInfo
GetStateTextA
GetStateTextW

powrprof

CallNtPowerInformation
DevicePowerSetDeviceState
IsPwrSuspendAllowed
PowerCreateSetting
PowerReadPossibleFriendlyName
PowerReadPossibleValue
WriteGlobalPwrPolicy
WritePwrScheme

uxtheme

DrawThemeText
GetThemeBitmap
GetThemeMargins
GetThemePosition
GetThemeTextMetrics
OpenThemeDataEx
SetWindowTheme

winhttp

WinHttpAddRequestHeaders
WinHttpCreateUrl
WinHttpGetDefaultProxyConfiguration
WinHttpOpenRequest
WinHttpReadData
WinHttpSetTimeouts
WinHttpTimeFromSystemTime

wintrust

CryptCATAdminReleaseContext
CryptCATEnumerateMember
CryptCATPersistStore
CryptCATPutMemberInfo
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain

wldap32

ldap_bindA
ldap_count_values
ldap_get_values_len
ldap_modrdn2_sW
ldap_result
ldap_sasl_bindA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 590KB - Virtual size: 590KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 44B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a65a403e1c7c25c9489ec735770ea39

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

d3dcompiler_47

evr

imagehlp

mpr

mscms

oleacc

powrprof

uxtheme

winhttp

wintrust

wldap32

Sections

.text Size: 3KB - Virtual size: 3KB

.data Size: 590KB - Virtual size: 590KB

.rdata Size: 512B - Virtual size: 48B

.bss Size: - Virtual size: 44B

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 128B

.text
Size: 3KB - Virtual size: 3KB

.data
Size: 590KB - Virtual size: 590KB

.rdata
Size: 512B - Virtual size: 48B

.bss
Size: - Virtual size: 44B

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 128B