7acd4739ad758bf2a95644a87aba6e00N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7acd4739ad758bf2a95644a87aba6e00N.exe
Size

43KB
MD5

7acd4739ad758bf2a95644a87aba6e00
SHA1

d2a44aa5f8fe852ed0e082a9af6e201b45c33ec6
SHA256

de0e02ae667de063e60334e6b2dcd17221b6b25e4ef7fd4b39770154c15cd48c
SHA512

e863d170f2db2f79694e08483e791d910a110a59b972a51db16f481d952200b41a2261f441dbecfebec11bd6225f6c87eb222682949d9a8841c41a3e300c4ac0
SSDEEP

768:QJYzsysjDaKyNzZxcEIjGD2uhSGzZeTd/taH90skEk8dl4QTbE8UTQ4g/y5Q4+99:TgysjKzzZeTd/taH90skEkyl4QTbE8Ui

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7acd4739ad758bf2a95644a87aba6e00N.exe

Files

7acd4739ad758bf2a95644a87aba6e00N.exe
.dll windows:4 windows x86 arch:x86

a7bdf027ee8bbacb3d601183c3ad92ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dev\server2\Steam\src\drm_rel_june09\release\survey.pdb

Imports

rpcrt4

UuidCreate

kernel32

LeaveCriticalSection
EnterCriticalSection
SetLastError
LockResource
SizeofResource
LoadResource
FindResourceW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
FindClose
FindNextFileW
FindFirstFileW
InitializeCriticalSection
lstrcmpiW
GetFileInformationByHandle
CreateFileW
DisableThreadLibraryCalls
GetSystemDirectoryW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleA
DeleteCriticalSection
DebugBreak
CloseHandle
GetVolumePathNameW

version

VerQueryValueW

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueW
RegCloseKey

ole32

StringFromGUID2

Exports

Exports

_runfunc@20

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ