2542bfc73566e261b0561d49a2557d8b | Triage

Sharing

General

Target

2542bfc73566e261b0561d49a2557d8b
Size

435KB
MD5

2542bfc73566e261b0561d49a2557d8b
SHA1

5d51667ea65496d780e10bb59b80ae110d29c2c7
SHA256

647b87eda3d86b73ae8c5e74e4a33ac768ed08e73de9b7582dbbebbd2ce70913
SHA512

d6ac46018ca5b04107a9f85aded036000d42511ed7edaee79692f280a02f5af367861f987c5bd9821788269af0c5aef70b09fb7896e13e87da76704ac97a8d6a
SSDEEP

12288:Uz7ql55AXsFhLI+us3fPgfLAd6gxuGaadVhRd7XilfCCHK9tKS:555X/I+uswjAcgZJ/ufxH+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2542bfc73566e261b0561d49a2557d8b

Files

2542bfc73566e261b0561d49a2557d8b
.exe windows:4 windows x86 arch:x86

7d0216f1e4b341dd2dd9592070ac9022

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

Sections

.text
Size: 20KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE