29c174c3fb242dbaa43ff5c897945c8d | Triage

Sharing

General

Target

29c174c3fb242dbaa43ff5c897945c8d
Size

48KB
MD5

29c174c3fb242dbaa43ff5c897945c8d
SHA1

901b47ee493826cb6774b5904313e11d295c05a7
SHA256

9c3e744f4cb1898b1b99aed87baf0f429569ba5efa37ed00fdcea60704eff690
SHA512

999db7f2cd3381177aaf8febb8a98a85f2524093190bff342132c0aad15bcd57fa85b7d033288ad7480a5f52e07be847ec375212c4be97d37241789dba5a1296
SSDEEP

1536:edivE3e1zYqIx30v/1J+ue5gN6/GYzowMqIP:exO1zfIWtJ+/75Mr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29c174c3fb242dbaa43ff5c897945c8d

Files

29c174c3fb242dbaa43ff5c897945c8d
.exe windows:5 windows x86 arch:x86

f50a4fcd4e85b7fca6785f01ff5bb305

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptGetHashParam
CryptReleaseContext
RegQueryValueExA
CryptCreateHash
DuplicateTokenEx
RegCloseKey
RegDeleteValueA

shlwapi

wvnsprintfW
wnsprintfW
SHDeleteKeyA
PathRemoveFileSpecW
PathFindFileNameW
StrStrW
wnsprintfA
StrCmpNIA
PathMatchSpecW
PathFileExistsW
StrCmpNIW
wvnsprintfA
PathCombineW

Sections

.nax
Size: 39KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vczet
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dqlyn
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ