04e42e378b517173cd43a40306740492 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04e42e378b517173cd43a40306740492
Size

249KB
MD5

04e42e378b517173cd43a40306740492
SHA1

341d1523ec36621995dc5a428f50d6f74dd38612
SHA256

7e84ccf2b559819c9771904cfce3768c3fbe8dfc1f137225653389c6afe68407
SHA512

e50f6f0bdfb3d2837d955cdd4e94ce3f1c350302cbe241e6b5d37b198c26318529608da4d8de3f153e06e176930d189a11d56bf2b04f711897074ed295340139
SSDEEP

6144:ebjFFyZaPDMOntdgFKdfUVNXBtFKm4Sn4ZpnJf:eHFFUkkvRtFH4Sgnh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04e42e378b517173cd43a40306740492

Files

04e42e378b517173cd43a40306740492
.exe windows:4 windows x86 arch:x86

01f98327eba33fc0904998d1c4e064dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateWindowExW

kernel32

LocalAlloc
GetCurrentProcessId
IsBadReadPtr
lstrcpynA
GetVersionExA
GetFileType
TerminateProcess
GlobalFree
GetStartupInfoA
QueryPerformanceCounter
LocalReAlloc
IsBadWritePtr
InterlockedIncrement
GlobalHandle
GetExitCodeProcess
GetThreadLocale
HeapCreate
GetSystemTimeAsFileTime
GetLocaleInfoA
HeapSize
SizeofResource
TlsAlloc
ExitProcess
SetFilePointer
GetACP
GetCurrentThread
GetOEMCP
TlsFree
VirtualFree
TlsGetValue
SetStdHandle
HeapAlloc
ReadFile
VirtualProtect
RtlUnwind
RaiseException
EnumResourceLanguagesW
TlsSetValue
CompareStringA
HeapDestroy
GetLastError
HeapReAlloc
FreeResource
GlobalDeleteAtom

oleaut32

DispGetIDsOfNames
VariantInit
OleTranslateColor
RevokeActiveObject
SetErrorInfo
VariantClear
SysReAllocStringLen

msvcrt

_controlfp

Sections

.text
Size: 163KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 302B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ