regedit[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

regedit.exe
Size

714KB
MD5

3cbc8f0042d09b3700fc59198eabbd32
SHA1

29b7d623505c7c04c3fb7c6362691acf07af32f8
SHA256

3143ede1d38783f4c5f5b68c7e720225223e1c802ebb641a8c7172d1397f99e2
SHA512

ba0909add63ea08a733f9e3d8bc956fcfa2f088b0de580470685cd0bfc038c5f12e13b486300c1e3db452925f258098c99fc28ba0d171a5cdca6cda43728e595
SSDEEP

12288:jK5eFE9Balg/mvOjQb5McMDUWrlG+yOWTtlO7tLBmYNSlTMNUku:V5Y5KTMm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
regedit.exe

Files

regedit.exe
.exe windows:5 windows x86 arch:x86

7f9237269b79ef6da48bd58e7736e33b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

python27

Py_FrozenFlag
Py_IgnoreEnvironmentFlag
PyImport_FrozenModules
Py_SetPythonHome
Py_SetProgramName
Py_GetProgramFullPath
Py_Initialize
PySys_SetArgv
PyDict_New
PyEval_EvalCode
PyEval_GetBuiltins
PyDict_SetItemString
PyObject_CallMethod
PyList_Insert
PyString_FromStringAndSize
PyExc_SystemExit
Py_NoSiteFlag
PySys_GetObject
PyObject_CallObject
PyImport_ImportModule
_PyString_Join
PyObject_GetAttrString
PyErr_Clear
Py_Exit
PyInt_AsLong
PyObject_Str
PyErr_Fetch
PyErr_NormalizeException
PyString_FromString
PyTuple_New
PyString_Format
_Py_NoneStruct
Py_Finalize
PyErr_ExceptionMatches

msvcr90

_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
__argc
__argv
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 704KB - Virtual size: 704KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f9237269b79ef6da48bd58e7736e33b

Headers

DLL Characteristics

File Characteristics

Imports

user32

python27

msvcr90

kernel32

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 704KB - Virtual size: 704KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 704KB - Virtual size: 704KB

.rsrc
Size: 1KB - Virtual size: 1KB