42b6911dcbc1cda14b4a9d733f172399 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42b6911dcbc1cda14b4a9d733f172399
Size

359KB
MD5

42b6911dcbc1cda14b4a9d733f172399
SHA1

6e6598a393fb9795c9ab76caaaa82335d4f15a98
SHA256

7d2aec9f7ea6d37425cd6f42d4dda05890c6ebeff4894b790204823d6bbee4ba
SHA512

ac5023b9e6a6b3069f24d8050744903dd52d7a2d94ca85b6f01fb80512f407183407c8b9b4ef27cfc9c3bde1ef8dc20f542b2c1cc1e41ed66cce202bc5be02db
SSDEEP

6144:c7l12U1csNzbGkVQoM4cMQwzwvKHHNcvhpFA6HNKMPpQpvGImG12Sv9bJ:c7l12U1hPq2AwzwyHHWv3FA6HN7PcO1o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42b6911dcbc1cda14b4a9d733f172399

Files

42b6911dcbc1cda14b4a9d733f172399
.exe windows:4 windows x86 arch:x86

6e2e3fb9d771935eaa438ef5a7c2c4fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetTempFileNameW
FindResourceW
FreeLibrary
LoadResource
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
WriteFile
LoadLibraryW
SizeofResource
FormatMessageW
GetModuleFileNameW
CreateFileW
GetProcAddress
GlobalFree
LockResource
CloseHandle
DeleteFileW

user32

MessageBoxW

shell32

CommandLineToArgvW
DoEnvironmentSubstW

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 343KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ