downloader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

downloader.exe
Size

36KB
MD5

a4c93ca41dc5e38ea92d6bb10ded4cd6
SHA1

f60493d3311351f51a6d397908462618829c6548
SHA256

bd9c56de7c72e14a1a93b38f096b0766da49a154b0bd3756f99b9f9aa8f42944
SHA512

6d86420eca6a473ff3a088c6f7332bef4df53784a8e9c6131873446c8a901aea290b38aa8678c4d4d329680f78a589227fd19c3bb7399e81f665d66ef6550c69
SSDEEP

96:To0MgAr71nxY9AAIvqZ2ZNHHsP4oynLKcm5OzG38U6p2WL4P4oyn:FJaPLjC2ZNHMP4oynLKL38jp2VP4oyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
downloader.exe

Files

downloader.exe
.exe windows:4 windows x86 arch:x86

aade0ea6fbdcd9b8e96fe999cae6f603

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
WinExec
WriteFile
CreateFileA
SizeofResource
CreateRemoteThread
FindResourceA
GetModuleHandleA
GetWindowsDirectoryA
MoveFileA
GetTempPathA
GetCurrentProcess
OpenProcess
CloseHandle
LoadResource

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

msvcrt

_snprintf
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_stricmp

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ