f60eac4d763a5fff732cffc6266b8f9a79d3851ace87b66bc1f36c8ece88d80dN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f60eac4d763a5fff732cffc6266b8f9a79d3851ace87b66bc1f36c8ece88d80dN
Size

37KB
MD5

6c263604f2942dc5ac06f77d92fd5450
SHA1

48143b91ec737a8c563e7b59f98257449c1aed56
SHA256

f60eac4d763a5fff732cffc6266b8f9a79d3851ace87b66bc1f36c8ece88d80d
SHA512

fc0677260355c2888dfe10510bef8abbf72221893ea4ff124d2076d8212103aa5d141714a6aa6b14791c854bf9dfcbd64200d9612ca0a73827b6485d6bd0af29
SSDEEP

768:ZxglSXl7sIKxj0yuv52OFF/n16CRqXwW214U/ZJ/A9:IlSKcvLFF/n1FcSPZB6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f60eac4d763a5fff732cffc6266b8f9a79d3851ace87b66bc1f36c8ece88d80dN

Files

f60eac4d763a5fff732cffc6266b8f9a79d3851ace87b66bc1f36c8ece88d80dN
.exe windows:5 windows x86 arch:x86

e003f18e5507304ae2c4ac2bc1b7535a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wtoi
??2@YAPAXI@Z
rand
srand
malloc
free
??3@YAXPAX@Z
memcpy
memset

kernel32

GetTickCount
ExitProcess

advapi32

OpenEventLogW
CryptHashData
CloseEventLog
RegCloseKey
CryptDestroyHash
ReportEventW
RegisterServiceCtrlHandlerW
RegOpenKeyExW
CryptCreateHash
SetServiceStatus
CryptAcquireContextW
CryptSetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptDecrypt
CryptSetHashParam
CryptGetHashParam
RegQueryValueExW
StartServiceCtrlDispatcherW

rpcrt4

RpcServerListen
RpcServerRegisterIfEx
NdrServerCall2
RpcServerUseProtseqEpW

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ