abaaffeb68ab3746ed8353430d2375e67ad63e984ec2f4a69a4c335e293739f2 | Triage

Sharing

General

Target

abaaffeb68ab3746ed8353430d2375e67ad63e984ec2f4a69a4c335e293739f2
Size

17KB
MD5

94bacf4736331d423326f965af51494b
SHA1

dd560e4607919e47182f07d8d048fc8f65c22467
SHA256

abaaffeb68ab3746ed8353430d2375e67ad63e984ec2f4a69a4c335e293739f2
SHA512

463cfa603b54023335b7e4691fde2cf47dc84388bcf21a346d61c04291473f13404f299f1a8657c4db9c8a374c3dcc2ddc91ca9fbd7984f2741f42d49444428f
SSDEEP

384:N3G/HBRcknCaqhXBm4WlLdGQCUc7ZlpHVkm5Dq6WemEeXq9ep:NW5Rc/aEXBPWlLxc7lVl5eVEC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abaaffeb68ab3746ed8353430d2375e67ad63e984ec2f4a69a4c335e293739f2

Files

abaaffeb68ab3746ed8353430d2375e67ad63e984ec2f4a69a4c335e293739f2
.exe windows:4 windows x86 arch:x86

1901fa132c99a01befe01f9af3f73cf0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetThreadContext
GetTempFileNameW
SetThreadContext
FreeResource
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualQueryEx
WriteFile
OpenProcess
SizeofResource
ReadProcessMemory
GetFileAttributesW
CreateProcessA
TerminateProcess
GetModuleFileNameW
CreateFileW
lstrlenW
GetTempPathW
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LockResource
Module32FirstW
lstrcatW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
WriteProcessMemory
ResumeThread
lstrcpyW

shell32

SHFileOperationW
SHChangeNotify

shlwapi

StrChrW
StrRChrW
StrCmpNIW

msvcrt

free
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
malloc
memmove

Sections

pe
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ