42a879a5afe2162c513d711dd42e0541d9fc3984880bc61615f350b6ee61c829 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42a879a5afe2162c513d711dd42e0541d9fc3984880bc61615f350b6ee61c829
Size

14KB
MD5

f1266a216e08262dd2b04efc4a15f4cd
SHA1

46a3fd57f66f42b00a3763866237a3f00e361c11
SHA256

42a879a5afe2162c513d711dd42e0541d9fc3984880bc61615f350b6ee61c829
SHA512

aa27723087c07bc2889fef1c4399b8ee7c262eeaec1734ff56eb2ce728421372dd0b7b9bec211a81ca360549f3e00028f15246cfa755579e3fcbf578e6e431bd
SSDEEP

192:8OcrEQ8XZGMxpJSwZCbP3TSEmZH46A3CzYWu58u51YxOfghs3nnnnnn+:foELIeMNmXA3CzYd5r51YxDh3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42a879a5afe2162c513d711dd42e0541d9fc3984880bc61615f350b6ee61c829

Files

42a879a5afe2162c513d711dd42e0541d9fc3984880bc61615f350b6ee61c829
.exe windows:4 windows x86

0492baea297996815693da7f4b834882

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleFileNameA
DeleteFileA
CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
GetCommandLineA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
ExitProcess
GetModuleHandleA

user32

PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA

msvcrt

rand
strrchr
malloc
realloc
_ftol
free

shlwapi

PathFileExistsA

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ