44a4c12a556d70a2566cc15e440aa8a4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44a4c12a556d70a2566cc15e440aa8a4
Size

24KB
MD5

44a4c12a556d70a2566cc15e440aa8a4
SHA1

8e09055cc9017a5b184cf380d93f5f8add895c1c
SHA256

eb01ab20675779b2aa758a84b702ad123c72919f5bf51d082f5dfe7760c3e346
SHA512

adddbe97915ec7d6bb6a0beac81949c781082fd8324198e6296f25f9e32d6b8726e5487fa9e3ef09854c99aec76599c0805fb30affe4d8364e92f7f5f3644ec1
SSDEEP

192:hN49FAYghLpP0k6CY7+RUbFKP1oynYPMxT:nUaYgpp8k27xbFU1WPMd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44a4c12a556d70a2566cc15e440aa8a4

Files

44a4c12a556d70a2566cc15e440aa8a4
.exe windows:4 windows x86 arch:x86

46dba7ebc5e7df9b99d0f86f518a56b1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord1200
ord2818
ord354
ord5186
ord1979
ord665
ord3318
ord5773
ord5442
ord6385
ord922
ord860
ord800
ord5572
ord2846
ord2919
ord540

msvcrt

__set_app_type
_except_handler3
_controlfp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_acmdln
exit
_XcptFilter
_exit
atol
_splitpath
_access
_tempnam
free
__CxxFrameHandler
__getmainargs
_stricmp

kernel32

DeleteFileA
CopyFileA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetCurrentDirectoryA
GetWindowsDirectoryA
GetSystemDirectoryA
Sleep
GetTempPathA

user32

GetDesktopWindow

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ