AntiSecuROM[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AntiSecuROM.exe
Size

32KB
MD5

cef7086777410b997e70670b15bda85d
SHA1

2154106bf4295d92c6c4c0dcf556282c92179a7a
SHA256

f21e7ac909b744ed0d9520fdc1ec7255ef29ea598d4a21e183511fcd108d88aa
SHA512

2b156cccfb70e1267cf6a6d41dfbf4b8204fbc9869ec1f8dd6c40f464420c5381dabd56fc9d58f317b63502bff405036892f606f05885c8809eeb8fb162e5825
SSDEEP

768:VhADuEus1/S4gaOqZpcXoxDgcd8VNPXl1Siv/AGGi2QXZMVTPqm:iuEus9waOPYSTVvv/WQXZk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AntiSecuROM.exe

Files

AntiSecuROM.exe
.exe windows:4 windows x86 arch:x86

8410db11bd499931ba8044943654b9a7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
lstrlenA
GetCommandLineA
GetModuleFileNameA
GetCurrentDirectoryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
WriteProcessMemory
VirtualProtectEx
GetProcAddress
GetModuleHandleA
ResumeThread
CreateProcessA
SetThreadContext
FlushInstructionCache
GetThreadContext
SuspendThread
TerminateProcess
RtlUnwind

user32

wsprintfA

comdlg32

GetOpenFileNameA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ