d0b8d1d9fe92b8408fb8fe0bc5994fe0N[.]exe | Triage

Sharing

General

Target

d0b8d1d9fe92b8408fb8fe0bc5994fe0N.exe
Size

23KB
MD5

d0b8d1d9fe92b8408fb8fe0bc5994fe0
SHA1

4594fdd96fb3724dd53de6eb6996bf8ac2b62a81
SHA256

a4f1cdaddbe88d491c3122211306712ac864df9d8f9e7b45c0722050940398b8
SHA512

67419d731858cdd466e02d97473ffee992a106b5e668e2e81c99ab183d360f9fb172e6d8444d56a2f6c356a8e47f71a3bd994494b49994311b244e7f49827e75
SSDEEP

192:lOs6GhM4SB91+owrer5/oQ00kVI+sW3MTWEXkSZ:Dm+9Q0DI+sW3MTWEXkSZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0b8d1d9fe92b8408fb8fe0bc5994fe0N.exe

Files

d0b8d1d9fe92b8408fb8fe0bc5994fe0N.exe
.exe windows:4 windows x86 arch:x86

0e49bfab28e3a76a2fd09d5188746004

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isctype
free
atol
__p__commode
strchr
strrchr
realloc
malloc
_stricmp
_strupr
__CxxFrameHandler
sprintf
toupper
??2@YAPAXI@Z
_EH_prolog
??3@YAXPAX@Z
_XcptFilter
printf
_exit
__getmainargs
exit
__p___initenv
_adjust_fdiv
_initterm
__setusermatherr
__mb_cur_max
__p__fmode
__set_app_type
_except_handler3
_controlfp
tolower
_pctype

advapi32

RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey

kernel32

WideCharToMultiByte
InterlockedDecrement
lstrlenA
OpenProcess
TerminateProcess
GetCurrentProcess
GetLastError
CloseHandle
ExitProcess
GetCommandLineA
GetCurrentProcessId

user32

GetWindowTextA
GetWindowThreadProcessId
PostMessageA
EnumWindows
LoadStringA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE