447ff5a2da1cd0a7cdd9ad3ef322ba20N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

447ff5a2da1cd0a7cdd9ad3ef322ba20N.exe
Size

1.1MB
MD5

447ff5a2da1cd0a7cdd9ad3ef322ba20
SHA1

245af709b67fd7c000aa986dfc7192cfd9fe4f7f
SHA256

3ef6f5446c2ef38f51382ab89ad1b91cde743f8de9750b4f2e591486746701d5
SHA512

2b5b587d60b019311a02ccebfbc243bd1d0bc66fd45ae05fa215e5ba4b999c8d1f88d63dae473e36ef4b23af0bfb8bf45e098075bb3b6db6ba6a5c32872d915c
SSDEEP

24576:tTrQL7K0SYG6Z13jZeyYh0ti4AbYs/T7X0xgJ6xdKPLEaDw9cfI1tfdf:tTaLZZ13ju+bUYATTY66jKPvDYcA1Bx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
447ff5a2da1cd0a7cdd9ad3ef322ba20N.exe

Files

447ff5a2da1cd0a7cdd9ad3ef322ba20N.exe
.exe windows:1 windows x86 arch:x86

c89894000dc11be3749d6bb00081db08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
WriteFile

user32

MessageBoxA
TranslateMessage

oleaut32

VariantChangeTypeEx

advapi32

RegQueryValueExA
AdjustTokenPrivileges

comctl32

InitCommonControls

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

shell32

SHGetFolderPathW

Sections

CODE
Size: 29KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 822KB - Virtual size: 824KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ