eb691bade66c87a5f374ab6a0beb6430N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb691bade66c87a5f374ab6a0beb6430N.exe
Size

2.3MB
MD5

eb691bade66c87a5f374ab6a0beb6430
SHA1

3f19ce17974923ed2b1b1eef9a05cd5597a7d31c
SHA256

a528feefc0363446f5808116253e01fa907829942ee4563e28ee17a203fc736c
SHA512

91abe4ac555f6d0ab56be42b3f50cde8e7fde7b5072a5dec38a919228b4ee1af3effe5cb27145840ddbb31d5eeec10297a1ab4e99217501498f27b867e3273b8
SSDEEP

49152:U9AkHkhju/9hmdgM+QySZobi2VgG8zlmc7oaGuiD:Pi4dgM+3SWv8zwuK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb691bade66c87a5f374ab6a0beb6430N.exe

Files

eb691bade66c87a5f374ab6a0beb6430N.exe
.dll windows:5 windows x86 arch:x86

152203babd3dd580a51f5e0d9f8cd028

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameW
EnterCriticalSection
GetFileTime
GetModuleHandleW
GetBinaryTypeW
GetLastError

mprapi

MprAdminMIBEntryGet

urlmon

FindMimeFromData

advapi32

OpenEventLogW

user32

OemToCharBuffW
GetUpdateRgn
HiliteMenuItem

rasapi32

RasGetSubEntryPropertiesW

shlwapi

StrCpyNW

gdi32

PtInRegion

imm32

ImmDestroyContext

shell32

DragQueryFileW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt0
Size: 712KB - Virtual size: 710KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.erloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ