c42172500b34b8be3ff0144179f59a5d | Triage

Sharing

General

Target

c42172500b34b8be3ff0144179f59a5d
Size

224KB
MD5

c42172500b34b8be3ff0144179f59a5d
SHA1

a83794dc4c163478b39c377aac5ce2032e7c80e2
SHA256

5b37951c6ccccb700f4f3a4cedf469432e0509a40a826582c5bc5bad21c345e6
SHA512

27f6ec75d7e437ab523ff126a2adb4cab2018e42a9cc68f842dc933f977fb1b2930535b7dc030dea8c3931c3ca7a784fae4cfc80cf3eadeb027c262f5cf7a28b
SSDEEP

3072:uGx81SJWmdvNhEg9Fj91WmuL1Vbh5BTT0vF/O7pesR4kHkTNaEIRMt1R7Hy/f9Yv:4yvNSulGHlTYvF/Ot7HEg1qRjy/fF03L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c42172500b34b8be3ff0144179f59a5d

Files

c42172500b34b8be3ff0144179f59a5d
.exe windows:6 windows x86 arch:x86

f86f9a1397ea2f648b8914df9ad78914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\rymyj\mskdla\kazh\1190cd5e2b8f4ba0b0ceda1d62e99267\nmnvbf\fkywzuik\Release\fkywzuik.pdb

Imports

kernel32

HeapFree
lstrlenW
WriteFile
CreateFileW
GetLastError
lstrcatW
CloseHandle
LoadLibraryW
HeapAlloc
GetProcAddress
ExitProcess
GetProcessHeap
EnumTimeFormatsA
WideCharToMultiByte

user32

MessageBoxW
LoadStringW
MessageBoxA

msvcrt

wcsrchr
memcpy
_wcsnicmp
memset

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ