oRDgAfX[.]exe | Triage

Sharing

General

Target

oRDgAfX.exe
Size

5KB
MD5

1f334c6da3a9a1beb53d38e566fdb216
SHA1

300406b30e2c820dd4ddc0054351e0ce951e815b
SHA256

92370396d10e8f498dcb58a6af5158dbaa871d7e8b958ea13e10ad1388278f73
SHA512

a8b5e741e60093859a48f077555f874217feda0f0128bdd06771d9300762a6c891770cb2a2e00c0ac2323f0430981d3087a57270970efe237c3089d7d5a63c0c
SSDEEP

96:17IWKINu62GnnLasTU9ig+wGs7YdDjSe9BWCyw/NzAwApAra6JhduV0:1UWTN52+SikGsgasBRNqSaYhduV0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

oRDgAfX.exe

Files

oRDgAfX.exe
.exe windows:4 windows x86 arch:x86

72caee80095d7901c5f615baded3f611

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

VirtualAlloc
CreateThread
WaitForSingleObject
CloseHandle
GetModuleFileNameA
CreateProcessA
Sleep
GetLastError
GetCommandLineA

ntdll

memcpy
memset
strlen
strcat
strncpy
strcmp

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceA
StartServiceCtrlDispatcherA

msvcrt

exit
strtok
malloc

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE