2ef8692764298ba823b41a3849bad31f4fb9141ee885707ae4dc043fb05ea494 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ef8692764298ba823b41a3849bad31f4fb9141ee885707ae4dc043fb05ea494
Size

150KB
MD5

4925c7838c045557f87cc2a0bdb2da7f
SHA1

abd56dbf036b9345d4dbfda80386734727b3d9ac
SHA256

2ef8692764298ba823b41a3849bad31f4fb9141ee885707ae4dc043fb05ea494
SHA512

e4cc007ca7ec10bea5b0e75af2d2e38d4fdc4c2d4fce9e91f3aaddd4b9339f40129b6e8a9bc40dda80e945d751efc6e5a747c16ab23e988851f0a8032fbd731d
SSDEEP

3072:P3BVlOiuZyDmbAdy7x/zCW/XDuC4BBeBiN7l2J4:Pbl1nDY6y9uCz0BeY6J4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ef8692764298ba823b41a3849bad31f4fb9141ee885707ae4dc043fb05ea494

Files

2ef8692764298ba823b41a3849bad31f4fb9141ee885707ae4dc043fb05ea494
.exe windows:1 windows x86 arch:x86

5e01feb0c8712b4079282e56efc8078d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
LoadLibraryExA
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
lstrlenA
CreateFileA
GetModuleFileNameA

ntdll

RtlLengthSid
RtlInitUnicodeString
RtlFreeHeap
RtlAllocateHeap

advapi32

RegOpenKeyExA
LsaClose
RegSetValueExA
RegQueryValueExA
RegCloseKey
LsaOpenPolicy

ulib

?GetLexeme@ARGUMENT@@QAEPAVWSTRING@@XZ
??0DSTRING@@QAE@XZ
??0PATH@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??1PROGRAM@@UAE@XZ
?ValidateVersion@PROGRAM@@UBEXKK@Z
?Usage@PROGRAM@@UBEXXZ

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ