28f48e674745d1cc944dad6ef9653750N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28f48e674745d1cc944dad6ef9653750N.exe
Size

63KB
MD5

28f48e674745d1cc944dad6ef9653750
SHA1

b265ab4b3417af6e64165ccd58d6b022536a20b2
SHA256

71889ec6c45f8c8e75bd4f358c7f928296299392b18d6dd8ccfb64c5faf4bfd6
SHA512

f16e699b8f75232c8499d272149dcf80bd802e306940927d655fd035c0637eeb87e803ab9fb868b8799b0c038b4d790a6574f89cc3b9c5ea10ed83313812e438
SSDEEP

1536:sDR0y3E57h6rcrXYMCB7xRzmCeceivbJU5I2SZOFVN3Bc/4FM9lzPiwRRKo7cWVo:sAqHdhNk/FsJOIy355w2Oy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28f48e674745d1cc944dad6ef9653750N.exe

Files

28f48e674745d1cc944dad6ef9653750N.exe
.exe windows:4 windows x86 arch:x86

905d4e46a403dd1856fbe1c81509bba1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsThreadpoolTimerSet
AddConsoleAliasA
WritePrivateProfileSectionA
FindFirstFileW
TermsrvSetKeySecurity
GetNumaNodeProcessorMask
WerRegisterRuntimeExceptionModule
lstrcpynA
ReplaceFile
SetUserGeoID

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE