42ab0e56ee1245fe253b4aace84ee8cb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42ab0e56ee1245fe253b4aace84ee8cb
Size

19KB
MD5

42ab0e56ee1245fe253b4aace84ee8cb
SHA1

c8736e931cc4e6e76142d156c188a7f6dfb77637
SHA256

a8ecf3a804e7efb86bee3b70b3eccc221acb00577e00dd673782f67ecb31c851
SHA512

8e26d62903e16f7b96389e21f147e80031d90c30eecc8bf4a6e25b4f1c0fe8a546c5032b93896dcef4ac5f4b7aaa0d9235056103bf8d6309dcf0d0dbb8c2e388
SSDEEP

384:yrXeEAWpMaumxvuIMNTrLqjK3moSV3WccCQ8Kt1ulnfWjvOeo:g24MBmCvqInStWcczBtoln

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42ab0e56ee1245fe253b4aace84ee8cb

Files

42ab0e56ee1245fe253b4aace84ee8cb
.exe windows:4 windows x86 arch:x86

1045c0bc4a1ac0e9e9ca922e532edcb3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetFileAttributesA
GetTempPathA
lstrcpyA
CloseHandle
lstrcatA
WaitForSingleObject
GetCurrentProcessId
WriteFile
SetFilePointer
CreateFileA
lstrlenA
GetModuleFileNameA
LoadLibraryA
RtlUnwind
ExitProcess
GetModuleHandleA
CreateEventA
SetEvent
CreateThread
GetVersionExA
ExitThread
GetProcAddress

user32

wsprintfA
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
ShowWindow
CreateWindowExA
SetThreadDesktop
CreateDesktopA
CharToOemA
GetTopWindow
PeekMessageA

advapi32

RegCloseKey
RegCreateKeyExA

shell32

SHGetFolderPathA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ