429635927[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

429635927.exe
Size

7.5MB
MD5

e74eafef23a34eec03b91aa62493ca15
SHA1

94bf8bba4fe1e973a5ac6739127c16d645d1156a
SHA256

1ffda4e6f64f044ffa2a79d8cf710b02014e7da5cd60300e8b08f615d5f81cc0
SHA512

9cf9a1dea10cd37af4975425f005552ff0405670c92376cdade41315911e3f6471b3ac25852ea8a21e31d94bc404de7a1336ac0322d049d562670e8f61fc81aa
SSDEEP

196608:OqeQ4Uv0SgzIbfyUmvVAkCTC7ipRdQYuUhKAzqeyAU7:5R4/SxfGGkKnpRdQYsAzq2U7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
429635927.exe

Files

429635927.exe
.exe windows:4 windows x86 arch:x86

a7573d19f9c5073bd6a125874d4fc0f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA

user32

PeekMessageA

advapi32

RegisterEventSourceA

comctl32

CreateStatusWindowA

shell32

SHChangeNotifyRegister

mscoree

_CorExeMain

Sections

.pdata
Size: - Virtual size: 11.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ctors
Size: 103KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE