9272ef4520a539cf18a3e673b8dd456d2d0a2407ba41aaffe870456400c2da08 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9272ef4520a539cf18a3e673b8dd456d2d0a2407ba41aaffe870456400c2da08
Size

12KB
MD5

5c4a68dae319bbe422f831593ed53c65
SHA1

24b9870cb706cfd0a85d9faef730e0872cf620bc
SHA256

9272ef4520a539cf18a3e673b8dd456d2d0a2407ba41aaffe870456400c2da08
SHA512

35e665b0b3bb987e2bc5c7302a979ddf778293fed256e61ba9feb995c8b86a8cd40916cf0337070d917340385ed65f19cdc33331a8eba1294200176d46849fe4
SSDEEP

384:ZoPipbJkh+7bhpX1BWl7xuDWFWlQxxxW4:mK7fhpXwY/AJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9272ef4520a539cf18a3e673b8dd456d2d0a2407ba41aaffe870456400c2da08

Files

9272ef4520a539cf18a3e673b8dd456d2d0a2407ba41aaffe870456400c2da08
.exe windows:5 windows x86 arch:x86

e030c9ce18032d898965fb09cc622ef7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ProcessIdToSessionId
GetCurrentProcessId
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
FormatMessageW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
LocalAlloc
LocalFree
GetModuleHandleW
GetProcAddress
GetStdHandle
GetFileType
WriteConsoleW
GetSystemTimeAsFileTime

msvcrt

__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__winitenv
_c_exit
_wcsicmp
_wcsnicmp
wcstoul
setlocale
_iob
vswprintf
vfwprintf
_exit
_cexit
_XcptFilter
wcslen
exit

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid

rpcrt4

NdrClientCall2

user32

wsprintfW

sfc_os

ord4
ord6
ord3

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE