f1ba0ddf42c327011308e935a5400caf497c8e5fd2659648d76e99ddfe126f76N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1ba0ddf42c327011308e935a5400caf497c8e5fd2659648d76e99ddfe126f76N
Size

502KB
MD5

213ef37dd990c9f5139a6be5d13f9420
SHA1

1ba3a4fc557b98452f48b08a9b54ad3a3504d83c
SHA256

f1ba0ddf42c327011308e935a5400caf497c8e5fd2659648d76e99ddfe126f76
SHA512

3b5428efead56db5ea8cab8f272009e44a31cc0fa43a6b035dbcac006e72548fabbd91ab2c2919f1f5b84bcdb2753ec2bad4b83d9b586f33d7e53412904f2e5f
SSDEEP

12288:5RonD6sOvA118sYCkwamja7bcZTrE5FC3elX/XICHMh:zoD6sOv618ErQAsXvICHY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1ba0ddf42c327011308e935a5400caf497c8e5fd2659648d76e99ddfe126f76N

Files

f1ba0ddf42c327011308e935a5400caf497c8e5fd2659648d76e99ddfe126f76N
.exe windows:4 windows x86 arch:x86

95579fa8573a7be092d767d6734f663f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLogicalDriveStringsW
GetDriveTypeW
CreateNamedPipeW
OpenMutexA
lstrcmpiW
FileTimeToLocalFileTime
GetStdHandle
GetVolumePathNameW
Sleep
lstrlenA
lstrcmpiW
HeapCreate
SetLastError
GetModuleFileNameA
IsValidLocale
lstrcmpiW
GetProcessHeap
lstrcmpiW
WaitForMultipleObjects
CreateMailslotW
GetModuleHandleA
DeleteFileA
lstrcmpiW

scecli

SceSysPrep
SceOpenPolicy
InitializeChangeNotify
DeltaNotify

Sections

.text
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 3KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ