ffa8cbfdceee016b5ee6279c4015d820N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffa8cbfdceee016b5ee6279c4015d820N.exe
Size

120KB
MD5

ffa8cbfdceee016b5ee6279c4015d820
SHA1

4988a8637be0556e9f5a6b590e9075f374584f8a
SHA256

f2a04d9585694daf24977dd5c2c8c81c809559b4f7d84683492d0055dc9573bf
SHA512

a1d05ab6036f845465533fbc61165d415c56cbcf2d7027814545d96142566ca6aec9a68892313839ae70db4fae0e04704e3b39aaf466cebf20b61a0a878ac3dd
SSDEEP

3072:cW8ofYIaDfqW/zXdf8eH34zaQnGADl9NjN+O:cuAjX/TB6aKBN+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffa8cbfdceee016b5ee6279c4015d820N.exe

Files

ffa8cbfdceee016b5ee6279c4015d820N.exe
.dll windows:4 windows x86 arch:x86

0f44bf2b3b0b8d5ecae5689ff1d0e90d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateProcessA
CloseHandle
WriteFile
CreateFileA
GetTickCount
lstrcpyA
lstrcatA
lstrlenA
GetTempPathA
SetErrorMode

user32

wsprintfA

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ