a1177b34999b4da2c0364c13fa393790N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1177b34999b4da2c0364c13fa393790N
Size

1.9MB
MD5

a1177b34999b4da2c0364c13fa393790
SHA1

0ee95ceaad62cf5194c43c14bb5ba70f89316a15
SHA256

e391442b3d2509e1abb4f6e9aced99e1a0ce3a18de0f6bcd36f13395ac450cd8
SHA512

25488586e85cb1a9a681eaa894a71532420c2d3d215e0fe787b0dac74b1e107b291b3ab664d74785f5f12c522de4975e52833aab53512c560efb28244f647870
SSDEEP

49152:9aOqoliTWISWd6QrfqV3qN7LRvSNf1xnU3QQctgWprxd5VXHB:4OqMWd6uC3qRlvSNf19U3QlrFXHB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1177b34999b4da2c0364c13fa393790N

Files

a1177b34999b4da2c0364c13fa393790N
.exe windows:4 windows x86 arch:x86

0cc009ca429f27a12a207c613c883a70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

msvcrt

__p__commode
__p__fmode
__set_app_type
_adjust_fdiv
_strlwr
_controlfp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
fseek
ftell
rewind
fread
strncmp
fprintf
??2@YAPAXI@Z
strrchr
strncpy
fwrite
fopen
fclose
setlocale
sprintf
??3@YAXPAX@Z
_except_handler3

kernel32

GetModuleHandleA
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
ReadFile
FindNextFileA
FindClose
GetFileAttributesA
FindFirstFileA
SetEvent
ReadDirectoryChangesW
WideCharToMultiByte
GetLogicalDrives
GetDriveTypeA
CloseHandle
CreateFileA
CreateThread
WaitForSingleObject
TerminateThread
Sleep
OpenEventA
CreateEventA
GetModuleFileNameA
CreatePipe

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ