baada729931aebb1a04aaf33395c53b0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

baada729931aebb1a04aaf33395c53b0N.exe
Size

139KB
MD5

baada729931aebb1a04aaf33395c53b0
SHA1

f363ac208ec9056d367453bfbdc0595052f58f7a
SHA256

32bb8fbaabbcbc89b6a9d920c42cd860f33bbaedaec88233caf467f40d7eba3e
SHA512

8996ede60ec0c382439e95284ea2a06c6ade1f8ede4f74320c61388d36b80aeb35b113076a383a3c81c0f82427cd64c746aff12bc88b06fbb3fa4af92f7816b8
SSDEEP

3072:kGToTK2Veq9MwwZVsxZNEo3HoVw3lKdouws:kGToG2UiXMs35qwVqws

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
baada729931aebb1a04aaf33395c53b0N.exe

Files

baada729931aebb1a04aaf33395c53b0N.exe
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ