9064ede7c90ef149b930cd3d16b85973ce542432e6fa806735f672aadc93b846N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9064ede7c90ef149b930cd3d16b85973ce542432e6fa806735f672aadc93b846N.exe
Size

727KB
MD5

8c7de570432d84ab055d9f8cccfe8c40
SHA1

cf7b4f491a59061b6e62e5718ca2be37aec6c327
SHA256

9064ede7c90ef149b930cd3d16b85973ce542432e6fa806735f672aadc93b846
SHA512

ca1ba3f7b02f6e370e0ff6723a770ca4eab00f739d181a176f9a6bac0229721d0cc0421f32869300827b9402559f9cc93c9cc1775e57aa7d3bfaac928911d666
SSDEEP

12288:pw22qcTnCywEjqMR/CB0tAHN9D1cR1n5DMsu3cYT8WTRlpSmSDCLM6J/IN2kkokZ:p9ObIEgB0i3DrsuH5pSmSDlu/kkokEkl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9064ede7c90ef149b930cd3d16b85973ce542432e6fa806735f672aadc93b846N.exe

Files

9064ede7c90ef149b930cd3d16b85973ce542432e6fa806735f672aadc93b846N.exe
.exe windows:4 windows

8ab140c7ff3f8e9ad1673e8bc3814b94

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VarUI2FromDec
RegisterActiveObject

ntdll

ZwAccessCheckByTypeResultListAndAuditAlarm
ZwSuspendProcess

ws2_32

gethostname

advapi32

GetAuditedPermissionsFromAclA

kernel32

DeleteTimerQueueTimer

user32

GetKBCodePage
GetForegroundWindow

Sections

.text
Size: 718KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE