42ed7b17997cb858525501a9770badbc | Triage

Sharing

General

Target

42ed7b17997cb858525501a9770badbc
Size

395KB
MD5

42ed7b17997cb858525501a9770badbc
SHA1

6242cf373dea4388d41c045b7ce9de476ccb693f
SHA256

00c212bb268aaba39fbc72ad2f3061ac95c7cf8c5e02b172fdc760edd4b2586c
SHA512

cc642750824f3d3e7911c1e4404b15ea1bde4a1ce429d51d584a1d73dc5dd8b84442766eba1844cef183d72152df32b992da1cc0175f749d688d5db29e7cf4eb
SSDEEP

6144:L/RJG8KMBU+xo2e+5bYwCOMeruVipEMS1BWKak/wGY4mswgIxhX8784glfs:LJU+xa8bAe6V1RUKakIGEz8Tsfs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

42ed7b17997cb858525501a9770badbc

Files

42ed7b17997cb858525501a9770badbc
.exe windows:4 windows x86 arch:x86

7b4928ca9b80dd55a38e89f9a6440f81

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
CreateFileW
LoadLibraryW
HeapCreate
GetComputerNameA
UnmapViewOfFile
CreateThread
ResetEvent
GetCurrentDirectoryA
FindClose
Sleep
CloseHandle
GlobalUnlock
LocalFree
PulseEvent
GetCommandLineW
GetSystemTime
lstrlenA
lstrcpyA
GetModuleHandleA

user32

DispatchMessageA
GetCaretPos
IsWindow
CreateIcon
GetDlgItem
CallWindowProcA
SetFocus
FillRect
CreateWindowExA
DrawMenuBar
GetDC
DrawEdge
CheckRadioButton

cryptui

CryptUIDlgSelectStoreA
CryptUIDlgSelectCA
LocalEnroll
CryptUIDlgCertMgr
WizardFree

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 371KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ