FoxitPDF[.]Pro[.]Patch[.]exe | Triage

Sharing

General

Target

FoxitPDF.Pro.Patch.exe
Size

124KB
MD5

08e7b4fc5f71a14379b8da2821c4ad63
SHA1

3d5c3f3cc66b864b3e2704b7055ab7d39c5c8c69
SHA256

c22ad277a17686cf3aff25144c433e8e625206e6209310ec3e96f75c210818c0
SHA512

2148049bafa45d1cae24ec69b652ac4c76ba728ed6a75b8dd1b571fba8e43e42c0382481f99ab23060c19766d3cfee1a59e73468693515319a499fd1e44c87e0
SSDEEP

1536:z7GafK0Rxo6h3jmgSPJLG06Ff6x9dpxbc+GBR2o5d9H/YN8rNFW6cq1EUriglcn+:vG10RG6Vjmg2LGrYdpNc+PoBLCqicTX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FoxitPDF.Pro.Patch.exe

Files

FoxitPDF.Pro.Patch.exe
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ