15bdbdf885173d325fbb3a77bea1ee60N[.]exe | Triage

Sharing

General

Target

15bdbdf885173d325fbb3a77bea1ee60N.exe
Size

188KB
MD5

15bdbdf885173d325fbb3a77bea1ee60
SHA1

183994b5640d37265301f926640269d43b0c30bf
SHA256

a300bc43b34be6dbb5da18701e1e93533b0fb3e8da96878ec10f1f2edf0b1c2c
SHA512

7fa9f205b60573e0ce9ab352e1e73f370402941f046b00d8e7088dbf515eb8957797d6d1376676d5918e09a5ad82e508c7c3af75140c0bc9a4558e5d583b89eb
SSDEEP

3072:1hYiCQXKgH7xFjsDlyk+AZ6cGdgwQDDu15/aE8tMgrkVCuLnT:n7xFGlyfAZ5DDuLymzT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
15bdbdf885173d325fbb3a77bea1ee60N.exe

Files

15bdbdf885173d325fbb3a77bea1ee60N.exe
.dll windows:5 windows x86 arch:x86

8fb9c33d660a73e17ccb39e76d1e6039

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegLoadAppKeyA
RegisterServiceCtrlHandlerA

crypt32

CryptFreeOIDFunctionAddress

gdi32

CreateColorSpaceA

winmm

waveOutGetPitch

setupapi

SetupCloseInfFile

mprapi

MprAdminMIBEntryGetNext

msvcrt

memset
strlen

ntdsapi

DsBindWithCredW

oleaut32

VarR8FromCy
VarDecFromR8

user32

UnionRect
ShowOwnedPopups

kernel32

GetModuleHandleW
LoadLibraryExA
GetModuleFileNameA
FindActCtxSectionGuid
GetGeoInfoW
Sleep

Exports

Exports

WeprmcFosller

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ