42eec493e8826aa3669b8d997784573f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42eec493e8826aa3669b8d997784573f
Size

18KB
MD5

42eec493e8826aa3669b8d997784573f
SHA1

da5ccfaae5926bbdbf035f1a6c7443c5c7c5a232
SHA256

c18dc2c45d345a5a4c9897b681a1783fd76787e2e5aff46d36706e84b400c8c0
SHA512

f80a9ca79be1d18e995687216ba2cb0ac9f32baa8ad9bf36f4cd308ed5c67241d9ffcf4cd865cb0b015b22593969f6b6b572707dfa664ca225c0fa2b3e6dd886
SSDEEP

384:DCvR/9r+V6vZwvBXjbz+J6n44FRG3oI+WlTbtpuyyFB0H8/LsMehaF:DCZFr+AsTb64FeHTbttHFDwF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42eec493e8826aa3669b8d997784573f

Files

42eec493e8826aa3669b8d997784573f
.exe windows:4 windows x86 arch:x86

a69b4a29fd67a45f547d26712a936ba5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA

msvcrt

fflush

ws2_32

gethostbyname

wininet

InternetOpenUrlA

user32

PostQuitMessage

advapi32

RegQueryValueExA

shell32

ShellExecuteA

Sections

pec1
Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE