29b06a19175969d764d115fa84eeea4c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29b06a19175969d764d115fa84eeea4c
Size

22KB
MD5

29b06a19175969d764d115fa84eeea4c
SHA1

5c73e7988b6af0b9fb8c37b77ac81c66b0f60cc8
SHA256

d778db87b4bb87e6138b7597f0281197e05cf08354cb6ff97759451283cd9a2d
SHA512

6a111a64ca7fd04d125719e9258ae668577b30974d8f6ecf269524913cd8a1c25d50611e0413eda6352d98a0dda343c9f9e3f49dffe3b6d6463daf5b8c6eadc2
SSDEEP

192:z+sHwk0bsBtPIcKyaViqeZu/3fMP0bkFDBQWul/zvzvyr5Pz3CDE:p0bKbKleu/PMP9WWu9LK9PzSo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29b06a19175969d764d115fa84eeea4c

Files

29b06a19175969d764d115fa84eeea4c
.exe windows:4 windows x86 arch:x86

34acee10a3c81ab7693044c6045505f5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

kernel32

AddAtomA
AllocConsole
ExitProcess
FindAtomA
GetAtomNameA
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fclose
fflush
fopen
fprintf
fputc
fputs
free
malloc
signal
strlen

user32

FindWindowA
GetAsyncKeyState
ShowWindow

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE