f72649e352cf4196d00c3c39b58900f0N[.]exe | Triage

Sharing

General

Target

f72649e352cf4196d00c3c39b58900f0N.exe
Size

1.1MB
MD5

f72649e352cf4196d00c3c39b58900f0
SHA1

c8ee252b35b6dd491a28720cf7afca8961285728
SHA256

ce4004f1c28881d1c6181c0a3ad53d4c41b3bf09ebd346c65b9a9a16f16bc18d
SHA512

56ce10d559471e188177671fb5ba1c7e44d26bc99ec6e4ce860ca85b8e38db299452517f9b21a8dfbabc49e343b0f031ffcd09436b4983f4d96018523c123198
SSDEEP

12288:USOP47es0e6yHPJCjn6EZ/Kp9rHmactE7gcJEAKWNTOlJ6NL:UBQes0e6yHL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f72649e352cf4196d00c3c39b58900f0N.exe

Files

f72649e352cf4196d00c3c39b58900f0N.exe
.dll windows:5 windows x86 arch:x86

b380277cbb8ae5571489cb34552d83fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

accept

kernel32

GetModuleFileNameA
CloseHandle
OutputDebugStringA
LocalFlags
BackupWrite

mprapi

MprInfoDelete
MprAdminMIBServerDisconnect

advapi32

RegOverridePredefKey
AddUsersToEncryptedFile

user32

TranslateMessage
wsprintfW
FindWindowExA
GetWindowThreadProcessId

shlwapi

PathRemoveBlanksW

winspool.drv

AddMonitorW

crypt32

CryptStringToBinaryA

msvcrt

memset

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ