1928[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1928.exe
Size

9KB
MD5

e1e00c2d5815e4129d8ac503f6fac095
SHA1

558f3dac7711b9b6209431916f1c455220df40a7
SHA256

20a3c5f02b6b79bcac9adaef7ee138763054bbedc298fb2710b5adaf9b74a47d
SHA512

aa77952ed68abbc4c7c1c56b3f5cb04f59e5495baaebb924fd82e1ccef8c3acd37c1f9c4abab11ba72a87e4f6607340c6312c14e2b1bb00d5715302f554af05e
SSDEEP

192:CfiRZmg3bAyrWbw1hMap10ROM64h/c+ggUTIRlwl/+XEB:qiayabwUawRd64h/cOESl2EE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1928.exe

Files

1928.exe
.exe windows:5 windows x86 arch:x86

2eeb9e4f6cd432901b60b83fbf9f02cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
ExitProcess
WaitForSingleObject
SetUnhandledExceptionFilter
SetErrorMode
CloseHandle
GetCurrentProcess
CreateThread
TerminateProcess
VirtualProtect
GetModuleHandleW
GetCurrentThreadId
GetTickCount
lstrcpyW
lstrlenW
GetProcAddress

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

user32

wsprintfW

Sections

.verif
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bin
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ