tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

21.8MB
MD5

04d54700f8274d32b60222bc1497ebf0
SHA1

1150c1a0e45c6ee5c671a5907c8f057ece4bc1e5
SHA256

eb41f9ce5d810092148309af2f932db5b938c57c9c2b8a5a5078e6cb45349b7b
SHA512

879667c69733b6edad159a5882b4f3a4a8f968c030b4a868742e591b61a5ff476b05f910bc3f2d64583f0bf385aaba6df4ee2ddbd91fbef0f9d74e8d05175fe1
SSDEEP

393216:/LfK/LS1/Lgntpvw2D3r4qg8RvPNJrHS7i9CPq7E0YIpUx9gZjpWQma9BKyIo9Xt:zIQy+qRvPn2+CP+EUE9vFo9L5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

tmp

resource
tmp

Files

tmp
.exe windows:4 windows x86 arch:x86

162d9ce2b26cb7af7c8fc8aa835ab1c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegGetValueW

kernel32

CloseHandle
CreateFileW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
GetLastError
GetStartupInfoW
GetTempPathW
InitializeCriticalSection
LeaveCriticalSection
SetFileAttributesW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteFile

msi

MsiCloseHandle
MsiGetProductPropertyW
MsiInstallProductW
MsiOpenPackageW
MsiSetInternalUI

msvcrt

__p__commode
__p__fmode
__p__wcmdln
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoUninitialize

oleaut32

SysAllocString
VariantInit

shell32

SHGetKnownFolderPath

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21.5MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 160B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 512B - Virtual size: 175B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 512B - Virtual size: 162B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

162d9ce2b26cb7af7c8fc8aa835ab1c7

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msi

msvcrt

ole32

oleaut32

shell32

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 21.5MB - Virtual size: 21.5MB

.rdata Size: 37KB - Virtual size: 36KB

.bss Size: - Virtual size: 160B

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 48B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1024B - Virtual size: 608B

/4 Size: 512B - Virtual size: 56B

/19 Size: 4KB - Virtual size: 3KB

/31 Size: 512B - Virtual size: 175B

/45 Size: 512B - Virtual size: 264B

/57 Size: 512B - Virtual size: 56B

/70 Size: 512B - Virtual size: 162B

.rsrc Size: 5KB - Virtual size: 5KB

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 21.5MB - Virtual size: 21.5MB

.rdata
Size: 37KB - Virtual size: 36KB

.bss
Size: - Virtual size: 160B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 608B

/4
Size: 512B - Virtual size: 56B

/19
Size: 4KB - Virtual size: 3KB

/31
Size: 512B - Virtual size: 175B

/45
Size: 512B - Virtual size: 264B

/57
Size: 512B - Virtual size: 56B

/70
Size: 512B - Virtual size: 162B

.rsrc
Size: 5KB - Virtual size: 5KB