mefivi[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mefivi.exe
Size

92KB
MD5

3f58d977a97fc1a4b8dcfcfbab68afcb
SHA1

76c3316f4d420af9f8cb6c928ff24e1687fbfa13
SHA256

bbbc97105176296903652ebf50a598b4e9a4787d0a87b046b5bb65f8afb8db26
SHA512

5ac0d083b8f1cc87c2859157f55af256421e24b35a6c85fd700266032273d02d257bd5725b2e5831a19f3baeab139c6545bd526417a6ac718d83f24d6bff034a
SSDEEP

1536:pD89cHnTWFI8tOyDmEI271TXRGUv+kT8CyD0N3dSoNHpy8TXog:pDVWqaRwm1XN4ND0hdSoNHA8X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mefivi.exe

Files

mefivi.exe
.exe windows:4 windows x86

2f6c6481898543e520964f065057c738

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameA

shell32

ShellExecuteA

comctl32

ord17
PropertySheetA
ord6

comdlg32

GetSaveFileNameA

gdi32

GetStockObject
EnumEnhMetaFile
PlayEnhMetaFile
SetMapMode
CopyEnhMetaFileA
DeleteEnhMetaFile
PlayMetaFile
SetWindowExtEx
GetEnhMetaFileHeader
CopyMetaFileA
DeleteMetaFile

kernel32

CompareStringW
SetEnvironmentVariableA
SetHandleCount
GetComputerNameA
GetLastError
FormatMessageA
GlobalUnlock
LockResource
LoadResource
FindResourceA
GlobalLock
WideCharToMultiByte
CloseHandle
WriteFile
CreateFileA
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetCPInfo
RtlUnwind
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
ExitProcess
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetProcAddress
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
HeapReAlloc
CompareStringA
HeapAlloc
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
VirtualFree
ReadFile
HeapCreate
HeapDestroy
GetSystemTime
HeapFree
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetLocalTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion

user32

GetWindowLongA
UpdateWindow
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
DrawTextExA
MoveWindow
GetWindowRect
SetDlgItemTextA
EndDialog
DialogBoxParamA
SetDlgItemInt
GetDlgItem
GetDlgItemInt
SetFocus
MessageBeep
ShowWindow
MessageBoxA
GetWindowDC
ReleaseDC
GetClientRect
SendDlgItemMessageA
BeginPaint
EndPaint
DefWindowProcA
SetCursor
GetClipboardData
InvalidateRect
GetClipboardFormatNameA
LoadStringA
wsprintfA
GetMenuItemCount
EnumClipboardFormats
InsertMenuItemA
CountClipboardFormats
OpenClipboard
CreatePopupMenu
DestroyMenu
CloseClipboard
GetMenuItemInfoA
SetMenuItemInfoA
EnableMenuItem
GetParent
GetMenu
LoadCursorA
SetWindowLongA
PostMessageA
RegisterClassExA
CreateWindowExA
LoadAcceleratorsA
SendMessageA
SetWindowPos
MapWindowPoints

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f6c6481898543e520964f065057c738

Headers

File Characteristics

Imports

advapi32

shell32

comctl32

comdlg32

gdi32

kernel32

user32

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 20KB - Virtual size: 18KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 20KB - Virtual size: 18KB