f1dadad8dee0ec7e0118aa9c1bab801bee3115501e865e2dacf95b76e52c7925 | Triage

Sharing

General

Target

f1dadad8dee0ec7e0118aa9c1bab801bee3115501e865e2dacf95b76e52c7925
Size

33KB
MD5

8f8a07f7b1f3032537d74dea607e8ed6
SHA1

78fe1329a5b8a0fd8a4d9041ef1edae4a7d1f59f
SHA256

f1dadad8dee0ec7e0118aa9c1bab801bee3115501e865e2dacf95b76e52c7925
SHA512

bf659d8205865d9d746fc7459d0a65f16b3cc33f10b5b57bc98a2dc7c50158c7fe807c1c47e05c8ec0b81e34181d008b859118f88fd4b461c65fbd7ea3e79a1a
SSDEEP

768:GNmKD0N8ytZ6QLr5Xrya4EuiHj0jszFNRGBefznvLArYs:KXol/Lr5Xua4jiHj0jsJNRue7vLE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1dadad8dee0ec7e0118aa9c1bab801bee3115501e865e2dacf95b76e52c7925

Files

f1dadad8dee0ec7e0118aa9c1bab801bee3115501e865e2dacf95b76e52c7925
.exe windows:4 windows x86 arch:x86

503956e4b41537adb4684826ffab284d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadContext
ContinueDebugEvent
CreateFileA
CreateThread
ExitProcess
GetCurrentDirectoryA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetThreadContext
GetVersionExA
IsDebuggerPresent
ReadFile
CloseHandle
Sleep
TerminateProcess
VirtualAlloc
VirtualFree
VirtualProtect
WaitForDebugEvent
WriteFile

wsock32

gethostbyname
WSAStartup
WSACleanup

user32

MessageBoxA

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 850B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE