www[.]DeadSec0000000000-obfusecator[.]exe | Triage

Sharing

General

Target

www.DeadSec0000000000-obfusecator.exe
Size

164KB
MD5

22d120454dd38d7f1a3f1cd0eb497f95
SHA1

4c11a082bf8e64b21310b959821a9f7324aa8107
SHA256

6fda5bd63e6647c70c7f420b4145898cada9e1a8bff4fca7f6a5859b648d217c
SHA512

1552101b7a22082eb69fe3485c53f595055bfc6db01ed14d4abc6f9cb9793e8ca3bc2f2448741fd8b4616f735c9f4f2e0299dc938d264103107fccbe68dc39a9
SSDEEP

3072:2QpshPjBCk79JFsCN5dbTA4ZbenYm7MHdcytrkueBuG1/dhRAJiYr:2QpshPjBCuJH5d3fZbeT4KueBu4jRsr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
www.DeadSec0000000000-obfusecator.exe

Files

www.DeadSec0000000000-obfusecator.exe
.exe windows:6 windows x86 arch:x86

eb3adbfdfdb25911eaec8fef643f639b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrNCatW
StrStrIW
StrCatW
StrCpyW

kernel32

SizeofResource
GetCurrentProcess
FindResourceA
GetModuleHandleA
LockResource
GetProcAddress
IsWow64Process
ExitProcess
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
LoadResource

advapi32

RegSetValueExW
CryptAcquireContextW
CryptGenRandom
RegOpenKeyExW
CryptReleaseContext

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
VariantInit
SysAllocString

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ