Amazing USB Flash Drive Recovery Wizard[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Amazing USB Flash Drive Recovery Wizard.exe
Size

19.8MB
MD5

25a19fda4b54056150c0fc4068487a7c
SHA1

fec400f4f3dbec810435fafee954004d9e701a27
SHA256

0f57ec805f704699efd5e1b9d7f1d583b51cfe4436dfd679772a6d9a4b63346d
SHA512

97be6451390aa3622a8d25eb6686d3688d85224c7b15b866ab9edf7059013bdf63bee1d57cf7d9690935c94adaf69177f959de6665e3a119324266af1380b2d2
SSDEEP

393216:2NGn3Q30pRNwxrzBTFk8YuwP1BMbAbfgwIU7q0aOOP6Kiz+P7+77yO:cmA3aUfvdw/MbAbIwI4qJP5z+X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Amazing USB Flash Drive Recovery Wizard.exe

Files

Amazing USB Flash Drive Recovery Wizard.exe
.exe windows:5 windows x86 arch:x86

2a23b322f4a5d4d7ef2a2b48495acd72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
IsWow64Process
GetCurrentProcess
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 1.9MB

.idata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ