14242[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14242.exe
Size

781KB
MD5

e62a8580edcb1395fba0d845e539c47b
SHA1

61a029bc45f01013015e9ea30120fcf135e1c236
SHA256

957fe77d04e04ff69fdaff8ef60ac0de24c9eb5e6186b3187460eac6be561f5d
SHA512

677971d0bcbba5e43f6216f56e82ae467240d7a965455a8cbceabcf70ccacecc290c9c0bfb64bfe35ad7aebe27a29485a7b0b9cf2806490b175e9d79c59d6423
SSDEEP

12288:Y00bvOxbo9dUVtwQkNqQbCFo83psZvkz7k0w8x9tfa4I9rzXHG:YtbcoPU3obCFxpsZvQg0w4i4I9r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14242.exe

Files

14242.exe
.exe windows:4 windows x64 arch:x64

cdf6b69984727961febd90936e4fbc39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddVectoredContinueHandler
AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetErrorMode
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTickCount64
GetVersionExA
GetVersionExW
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
IsDBCSLeadByteEx
K32EnumProcessModules
K32EnumProcesses
K32GetModuleBaseNameA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetErrorMode
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_beginthreadex
_cexit
_commode
_endthreadex
_environ
_errno
_fmode
_initterm
_localtime64
_lock
_onexit
_snprintf_l
_stricmp
_strnicmp
_strtod_l
_unlock
abort
calloc
exit
fflush
fprintf
fputc
free
fwrite
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
signal
strchr
strcmp
strcspn
strerror
strlen
strncmp
strrchr
strspn
vfprintf
wcslen
_strdup

wininet

HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetReadFile
InternetSetOptionA

ws2_32

WSACloseEvent
WSAConnect
WSACreateEvent
WSAGetLastError
WSAPoll
WSARecv
WSAResetEvent
WSASend
WSASetEvent
WSASocketA
WSAStartup
WSAWaitForMultipleEvents
closesocket
freeaddrinfo
getaddrinfo
htons
ioctlsocket

Sections

.text
Size: 573KB - Virtual size: 573KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cdf6b69984727961febd90936e4fbc39

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

wininet

ws2_32

Sections

.text Size: 573KB - Virtual size: 573KB

.data Size: 63KB - Virtual size: 62KB

.rdata Size: 83KB - Virtual size: 83KB

.pdata Size: 24KB - Virtual size: 24KB

.xdata Size: 24KB - Virtual size: 23KB

.bss Size: - Virtual size: 8KB

.idata Size: 6KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 573KB - Virtual size: 573KB

.data
Size: 63KB - Virtual size: 62KB

.rdata
Size: 83KB - Virtual size: 83KB

.pdata
Size: 24KB - Virtual size: 24KB

.xdata
Size: 24KB - Virtual size: 23KB

.bss
Size: - Virtual size: 8KB

.idata
Size: 6KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 4KB - Virtual size: 3KB