TapiUnattend[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TapiUnattend.exe
Size

11KB
MD5

fbd07354e3ecd632bbc9b49da0067fc5
SHA1

171a70f4b3414e87c917602fe7136f1af22fdd06
SHA256

b4e32ebc08ba8e7e2d952e7baeadddd971b5f6357066ba64d1a69c02daaa33ad
SHA512

9e83359c5ad6a3e1130d043ad2ad9bcab63f18a153572ba724e142d078e0b093a6285020d309ee1ac7f469f94737661473368a7fc6ced58e920a81bf070ece99
SSDEEP

192:R7uhpEWZdw9MllE8dImSKf2Kcqllr4LBy2lLHJEVMXVMN1GaW/iRUW:xczYMf+Q2hSMLblLHCqVsGaW/iRUW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TapiUnattend.exe

Files

TapiUnattend.exe
.exe windows x86

2e115147cf7ac4de357febfbd202ee6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW

kernel32

GetLastError
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

__set_app_type
_except_handler4_common
?terminate@@YAXXZ
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
??2@YAPAXI@Z
??3@YAXPAX@Z
_controlfp

wdscore

WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 586B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ