ef374908d3171169e9c63cd20565c3b0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef374908d3171169e9c63cd20565c3b0N.exe
Size

209KB
MD5

ef374908d3171169e9c63cd20565c3b0
SHA1

394dc78a8c9f25352f9e2c2d312a61636b89498a
SHA256

d103415b4d0e8352e4beda338bca3a46d1438e14f6aa9fe270a845654e755b8c
SHA512

1664faf901f96898b9348d566d9f086741eda65069cbcab6ef91439c5b3a074b5deccccc9c717656c655d22ad24f22807a347bdf253a70f3df686394bb0db120
SSDEEP

3072:l6VhmKTCs1C/CBPY6gMs2D6aB5tP0gwBZl6hml6+x9SGml35k3yXbod:4XG8nBQTSZtSBZgG6+zbgOwbod

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef374908d3171169e9c63cd20565c3b0N.exe

Files

ef374908d3171169e9c63cd20565c3b0N.exe
.exe windows:4 windows x86 arch:x86

aa644a7e734b8527a8f0862a7620a80e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

pautoenr

CertAutoEnrollment
CertAutoRemove

kernel32

QueryPerformanceCounter
LoadLibraryW
lstrcmpA
WideCharToMultiByte
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
SetLastError
lstrcpyA
HeapFree
lstrlenA
GetProcessHeap
GetVolumeInformationA
DeviceIoControl
CreateFileA
MultiByteToWideChar
QueryDosDeviceA
GetLocalTime
GetCurrentThreadId
GetStartupInfoA
FreeResource
LockResource
GetCurrentProcessId
CloseHandle
LoadResource
GetTickCount
HeapAlloc
FindResourceA
SystemTimeToFileTime
GetCurrentProcess

advapi32

RegCloseKey
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA

user32

CharNextA
wsprintfA

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ