49d8b620009bdcae448428a0726d6b48 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49d8b620009bdcae448428a0726d6b48
Size

187KB
MD5

49d8b620009bdcae448428a0726d6b48
SHA1

f3716da348a1575cefe3d566128ee8f40a0b6424
SHA256

e5e289bde360db7cf1ed26cd9df3fc29ba4ff08dc31a7df144df74dad98c3cfc
SHA512

6abbd138f123772f139de7a6146a7bcdceeba7e56b2e7edb48e9cf2448c15161f5ff39a693d53e989749c5e433b1a857f58572875ddaa25c8c0689b30161039c
SSDEEP

3072:I1VnyLT12UiX9zuC5nwngkQ4hbTA0Ij86DhfCSo/WGHEfElm7mYb6oPJgkLsiS05:I1V412UiXpX5wnZIjNo/pIlbjh1Xx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49d8b620009bdcae448428a0726d6b48

Files

49d8b620009bdcae448428a0726d6b48
.exe windows:4 windows x86 arch:x86

e97509496f9576461532c0c2c1414196

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

PostThreadMessageW
RealGetWindowClass
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW

kernel32

CreateFiberEx
FileTimeToSystemTime
TerminateJobObject
GetTempPathW
EnumResourceNamesW
FlushFileBuffers
LocalAlloc
SetEvent
RaiseException

shlwapi

wnsprintfW

ole32

CoAddRefServerProcess
CoUninitialize
CoInitialize
CoTaskMemFree
CoRegisterMessageFilter
StringFromGUID2
CoResumeClassObjects
CoRevokeClassObject
GetRunningObjectTable
CoRegisterClassObject
CoCreateInstance
CLSIDFromString
CreateStreamOnHGlobal
CreateClassMoniker
CoDisconnectObject
CoReleaseServerProcess
CoTaskMemAlloc

iphlpapi

NotifyRouteChange

rpcrt4

UuidCreate

advapi32

RegOpenKeyExA
EncryptFileW
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
DecryptFileW

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ