RegFuck[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RegFuck.exe
Size

12.1MB
MD5

bc07cf3f4273ec6e159812e5ceb70904
SHA1

b32c4a1dfff0096eb3fb92e823d715edddca0ce0
SHA256

500fe9a271faa02692f1247bdbee20efa98f4c41b8466347dabe0b8166ffe863
SHA512

93f4a98225349c485e4792d36e56621f9be86834b0385d67930ab10a2fe688c515970300cefc4968988021f273885db8e480ebf78ffd89bc33178bc67805d411
SSDEEP

196608:DuW39IjYpOPCqMvvfng2OM20giL+PtHfDCBLyC3Ozm1KuQ:7NIjyCCqMvg/0giqAkA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RegFuck.exe

Files

RegFuck.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 12.1MB - Virtual size: 12.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ