28864a86fac6b696529cab8651cd3400N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28864a86fac6b696529cab8651cd3400N.exe
Size

28KB
MD5

28864a86fac6b696529cab8651cd3400
SHA1

9c678ebddd00eae8e987d57ba654a4fd52e4831f
SHA256

47d78788f7cad9318a326af56bfdf17efc59344c8cef7923e277f25246f5d5be
SHA512

5a26a4fad18c093f7457433cc5f986d161094d568590d2cad6c21cd1e91757c2560feb5081e3ed1231e258a43f8a3b2ccb3600dd0d826438f6c337840c8f52a2
SSDEEP

384:0u1MfDP3WwG1pB/yQWOO/+094giPNPHaMCwG7l:dSa/XB/KTG0GgiFHxXSl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28864a86fac6b696529cab8651cd3400N.exe

Files

28864a86fac6b696529cab8651cd3400N.exe
.exe windows:4 windows x86 arch:x86

8b952403cd7980f20cd10a1500bc5902

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

StgOpenStorage
CoInitialize

kernel32

RaiseException
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
Sleep
TerminateProcess

advapi32

CredFree

dhcpcsvc

DhcpDeRegisterParamChange

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ