TapiUnattend[.]exe | Triage

Sharing

General

Target

TapiUnattend.exe
Size

12KB
MD5

4ae8766d10418e2d254f3abe1dbd9f24
SHA1

32b3bfc3bae4cc59ff3d84095b38c8ac68d1b30f
SHA256

fc6fd4e38e45fa2e9e224f06913110d291f3dd8bdfd2f93897b77fb418337919
SHA512

f3e35342683c3af3bbadbe4c58df85940029b8318a140199ef508dd08e92a414bae98606a5aa8ba7a9dbbcb67facca68a163d9a4a1a1b966ad85fd914f716026
SSDEEP

192:badkYPdilaawhFDgCoX1sTnZD0jBo9bL81MNGyW/BUeUWBfmt:2vPUYnALX1Wn6jO9pGyW/BBUWBf+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TapiUnattend.exe

Files

TapiUnattend.exe
.exe windows x86

190a7bb5628192cc38f28aeb38d3799a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW

kernel32

GetLastError
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
TerminateProcess

msvcrt

_except_handler4_common
_controlfp
__p__fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
??2@YAPAXI@Z
??3@YAXPAX@Z
?terminate@@YAXXZ

wdscore

CurrentIP
ConstructPartialMsgVW
WdsSetupLogMessageW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ