file[.]None[.]0xff150658[.]img | Triage

Sharing

General

Target

file.None.0xff150658.img
Size

9KB
MD5

88f55bed9f5c953fc480d629eb32e0a9
SHA1

1f74edd998aec625fa5e9d8fede71f60e188b6f8
SHA256

e121156fc9c986d09e2a774aba557d088ffdd85689b12cad8b252c227b5d434c
SHA512

b16224f52ba4a247760f14a6a0aec432c071b9b44e25c8687f2df222bd09f740daba16849597d5a4b42057a3a2889422a90b4c5275953c11e693157845ef39fb
SSDEEP

96:Ddg3FyaPV9jndU7+vTl3v2/Mnd/KvqMpMnamWrQOl+CTLdWmWw:S1dr+70Tl3vEM/iaamWrx+ClWmW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.None.0xff150658.img

Files

file.None.0xff150658.img
.exe windows:4 windows x86 arch:x86

3163558c135907c1c351bec6129aad23

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwOpenFile
ZwReadFile
_vsnprintf
ZwQueryValueKey
ZwOpenKey
RtlWriteRegistryValue
ZwWriteFile
_snwprintf
RtlDeleteRegistryValue
ZwClose
RtlInitUnicodeString
_snprintf
memcpy

kernel32

ExitProcess
FindFirstFileA
DeleteFileA
FindNextFileA
GetModuleFileNameA
MoveFileExA
GetTempPathA
SleepEx
CloseHandle
GetTickCount
GetFileAttributesA
HeapAlloc
GetProcessHeap
HeapFree
BindIoCompletionCallback

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ