748d4b4cbdd59c58932f0c88f1f17601[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

748d4b4cbdd59c58932f0c88f1f17601.exe
Size

12KB
MD5

748d4b4cbdd59c58932f0c88f1f17601
SHA1

1882f0db0a980b60d4fd1ed7fb01f2c4333e304b
SHA256

c27e211d6556d69253b8e6859e150aa6122addd99530e8e6ebba4fd40b7739ac
SHA512

6ef9c4ee9437970bb37343d8c4bf94c6370a2f37d787af28ac1ad3cadd833ec602533cdcb5e9ecf464b6d0c21955a3c6608a2b3d10a68a1e9a8b928c7e73c678
SSDEEP

192:AShvI1t9jhck6eMGBc9TNAC1ckGqPGcGrImCWlJdxqHn1x:Lsjy+LjtxJCWlJj+1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
748d4b4cbdd59c58932f0c88f1f17601.exe

Files

748d4b4cbdd59c58932f0c88f1f17601.exe
.exe windows:4 windows x64 arch:x64

8930eb76f39d7865d551d28385bb57c4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

memset
printf
memcpy
memmove
rand
wcslen
strcmp
srand
strtol
_wsystem
_vsnprintf
_vsnwprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

kernel32

FileTimeToSystemTime
GetProcessHeap
HeapAlloc
HeapSize
HeapReAlloc
CreateFileW
GetLastError
Sleep
WriteFile
HeapFree
CloseHandle
SleepEx
GetCommandLineW
ExpandEnvironmentStringsW

ntdll

NtQuerySystemInformation
RtlGetNtVersionNumbers

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle

bcrypt

BCryptDestroyKey
BCryptDestroyHash
BCryptProcessMultiOperations
BCryptCreateMultiHash

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ