4e21742366d4232156bdee63d9220a80[.]exe | Triage

Sharing

General

Target

4e21742366d4232156bdee63d9220a80.exe
Size

119KB
MD5

4e21742366d4232156bdee63d9220a80
SHA1

6ab519ea106416de22b86c0efd061377e6692a9c
SHA256

89ac2d35964afe09b6713a61cb5b3a6f2705a86523e192bb89cd64919538f9dc
SHA512

106fb8127c1caeda3aadc44ea1720379a52a5abd8f5580384630ecbeef6ad5f0a327bb4d08f27826a0657c63d4ed9cf43ecac8dd1713b82de0fa1e49ec2f02f4
SSDEEP

3072:9U0x873ERamQmQEJPbq5VvqTAL1qUUTsI/r7T:9hqIamTQEJe5VvuY6sI/r7T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e21742366d4232156bdee63d9220a80.exe

Files

4e21742366d4232156bdee63d9220a80.exe
.exe windows:4 windows x86 arch:x86

3a894727f8764204893ee996a24043fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
K32GetWsChanges
WerUnregisterFile
RemoveVectoredContinueHandler
WerRegisterRuntimeExceptionModule
SetFileApisToANSI
SetFileShortNameW
BasepIsProcessAllowed
LocalReAlloc
InterlockedCompareExchange

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE