42d47df6750f78b342adf6a0ee4f8f05 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42d47df6750f78b342adf6a0ee4f8f05
Size

17KB
MD5

42d47df6750f78b342adf6a0ee4f8f05
SHA1

4c25803f41c3fce1c37a01cb1b34f369db68bdc6
SHA256

a97fe4de59724e9dcebd9709a00799c2a998e2a29ed4d28c908ca91345d10e15
SHA512

dc708e61b0031ff0a89458767313e1e6a2d0069857d181463ad6517a095169e91198ecbb1098b6e07560eef1bc451d278ba751d883fe986b7cd809d0462c28e8
SSDEEP

384:VdYJiF/e/ZaM3NqlXn08K0999999b6m99999DM999rk3gmsf6:UJiFG/5300B0999999b6m99999DM999Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42d47df6750f78b342adf6a0ee4f8f05

Files

42d47df6750f78b342adf6a0ee4f8f05
.exe windows:4 windows x86 arch:x86

375fab25f9527f8f3eb09091f8c6c583

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
Process32First
ExitProcess
Module32First
Process32Next
ReadProcessMemory
CreateProcessA
ReadFile
lstrcatA
GetProcAddress
LoadLibraryA
LocalAlloc
GetThreadContext
DuplicateHandle
Module32Next
CloseHandle
GetFileSize
FindResourceA
GetTempPathA
LocalFree
lstrlenA
ResumeThread
LoadResource
GetCurrentProcess
CreateRemoteThread
WriteFile
IsDebuggerPresent
SetUnhandledExceptionFilter
CreateToolhelp32Snapshot
GetModuleHandleA
GetModuleFileNameA
CreateFileA
lstrcmpA
UnhandledExceptionFilter
TerminateProcess
RtlUnwind

user32

MessageBoxA

advapi32

RegCloseKey
GetUserNameA
RegQueryValueExA
RegOpenKeyExA

shlwapi

PathFindFileNameA

Sections

.f0Gx
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ