a9efaa71d389536c5df61fc6b6f110a0N[.]exe | Triage

Sharing

General

Target

a9efaa71d389536c5df61fc6b6f110a0N.exe
Size

188KB
MD5

a9efaa71d389536c5df61fc6b6f110a0
SHA1

2ec1ff0e99203c24afc3d453eef53baea8a1ae42
SHA256

c85b8803ce450f24ceb194c5989a902db2ab0571ff6cd7a49a31ba311d894f7c
SHA512

721d02896886a55d5cf910a1fcbc0a3b7d4aeb1c2189993f4c94fceedc46109fd3881a897cdb1282d544250fb5ac53319c7460053aeed58a5fa81a9b31b28e92
SSDEEP

3072:LhYiCQXKgH7xFjsDlyk+AZ6cGdgwQDDu15/aE8tggrkVCuLnT:d7xFGlyfAZ5DDuLyqzT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
a9efaa71d389536c5df61fc6b6f110a0N.exe

Files

a9efaa71d389536c5df61fc6b6f110a0N.exe
.dll windows:5 windows x86 arch:x86

8fb9c33d660a73e17ccb39e76d1e6039

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegLoadAppKeyA
RegisterServiceCtrlHandlerA

crypt32

CryptFreeOIDFunctionAddress

gdi32

CreateColorSpaceA

winmm

waveOutGetPitch

setupapi

SetupCloseInfFile

mprapi

MprAdminMIBEntryGetNext

msvcrt

memset
strlen

ntdsapi

DsBindWithCredW

oleaut32

VarR8FromCy
VarDecFromR8

user32

UnionRect
ShowOwnedPopups

kernel32

GetModuleHandleW
LoadLibraryExA
GetModuleFileNameA
FindActCtxSectionGuid
GetGeoInfoW
Sleep

Exports

Exports

WeprmcFosller

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ