reg[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

reg.exe
Size

28KB
MD5

561250254c98392c989a0bd4de1d59bb
SHA1

c97467df076468aedd707116f3a5861af217006b
SHA256

237e36e4cfbbe9de370c1ea3d9a7aa982883d9b50e443f52c8fd801a456a09b7
SHA512

1a50f756c845a68c80f356ddc9c0a190665eb1ad6409eb0fe8edbcf81e18ef9bf7867a2876eeceec51dfc70f67c7dd7d1d8a2aef14084936a90aee3012ea3a61
SSDEEP

384:54RtNW11mlDgMTmfSpgHkEGeawMRMRyOzvZsDNyD8MExbEooxi:+RrW1QmfLHzG4MRMRBDcN08M4bnox

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
reg.exe

Files

reg.exe
.exe windows:4 windows x86 arch:x86

f406c40c8ea892b1ef4acbf8f7b09e27

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetFileSize
ReadFile
CloseHandle
GetFileType
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetCurrentDirectoryA
GetStartupInfoA
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
WriteFile
GetLastError
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetFilePointer
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegCreateKeyExA
RegSetValueExA

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE