8e9a9d0bf928cce548b4e02ee24303d2f7c58a300175efb622700eedd38bcd2b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e9a9d0bf928cce548b4e02ee24303d2f7c58a300175efb622700eedd38bcd2b
Size

353KB
MD5

6a5b55f9d64627292e9bb41065b191f8
SHA1

e60621eb4881aeaf7049c20003fc69b796ca7613
SHA256

8e9a9d0bf928cce548b4e02ee24303d2f7c58a300175efb622700eedd38bcd2b
SHA512

84e6d91e40cb197f9c498a0e375ac848cb29904d21abe3ea3d19f36d32f71b8cdf82eeb93e4922cc870b1179f4bd40d2f103bf1c356393818d52fee6a34fa679
SSDEEP

6144:LAUTxSfmI9HkzI6I9hmlntl3Cp4E8gb2QxmJj:LAxfbE06Jlnz34BnSQUV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e9a9d0bf928cce548b4e02ee24303d2f7c58a300175efb622700eedd38bcd2b

Files

8e9a9d0bf928cce548b4e02ee24303d2f7c58a300175efb622700eedd38bcd2b
.exe windows:5 windows x86 arch:x86

eb72c8b416e71facfb6beb377e02c6b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
VirtualAlloc
CloseHandle
CreateFileW
DeviceIoControl
GetModuleHandleA
GetDriveTypeW
GetLastError
GetModuleHandleW
GetStartupInfoA
LocalFree
FormatMessageW
ExitProcess

user32

DialogBoxParamA
SetFocus
LoadCursorA
LoadIconW
LoadIconA
LoadCursorW
DialogBoxParamW
EnableWindow
GetDesktopWindow
GetDlgItem
IsDlgButtonChecked
LoadStringW
MessageBoxW
AnimateWindow
EndDialog

advapi32

RegOpenKeyExW

msvcrt

_XcptFilter
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_initterm
exit

Sections

.text
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ropf
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ