FastCopy[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FastCopy.exe
Size

486KB
MD5

27f44172963bcb60df4b46d686fc9733
SHA1

4d53cc5459967a3f504dc115e22a748aad20a4ae
SHA256

648cdd4ee1456f187f8be970b6a476e017e882e519b9cd2bdfbe1c2ab7d5c201
SHA512

0b684344514486be0f178c1eee4c58ff38987baa7ab16e3508f0154b073a5e3a89ab8f8c6d729d2cf481b9432904699d76334677a4731bdd0d2be552b0b85397
SSDEEP

6144:A5fNAR1E6vp9JUkzeA6cpNVNaug9Lx92I2T0qfO3p1o1Q8/jKm/3ZXLHtOZ1UCIE:EihtdVNRggTlOZ16QO/3ZXgZwm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FastCopy.exe

Files

FastCopy.exe
.exe windows:5 windows x86 arch:x86

79b321607ee0c7b5ba6a98eb7a81e5fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

oleaut32

SafeArrayGetUBound

Sections

.MPRESS1
Size: 343KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE