49e7b08cf644f77dd2a4b9ede2c815a8 | Triage

Sharing

General

Target

49e7b08cf644f77dd2a4b9ede2c815a8
Size

24KB
MD5

49e7b08cf644f77dd2a4b9ede2c815a8
SHA1

cc33d6c392ddbf72c9d1d34834908db27e53305f
SHA256

3b6f8a91720eaa8a5bee84733e82bd41a192b03eb5b629d9c2c16817eff86e36
SHA512

cf9664cfbb05ea2b8dae298e85d9404674b09ccddfcfdd44ea7e61cc57341d2e10341d3b103efcaa27a390cdf801f77e33660d0e973bfc11d44f2276c3c19866
SSDEEP

192:4Y6OSjaG26rAxOpzA/XskDFyFNTZtn9zHJ5T+nsbM61oyacMSs8:4Y6Og2I5zA/nDFcvx+nX61Q5St

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49e7b08cf644f77dd2a4b9ede2c815a8

Files

49e7b08cf644f77dd2a4b9ede2c815a8
.exe windows:4 windows x86 arch:x86

6559d3cd093f259158873b96647246a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetProcAddress
FreeLibrary
LoadLibraryA
Sleep
GetSystemTime
GetTempPathA
CreateProcessA
DeleteFileA
Process32First
ExitProcess
GetCurrentProcessId
GetStartupInfoA
GetModuleHandleA
OpenProcess
CloseHandle
Process32Next

msvcrt

_strcmpi
_controlfp
??3@YAXPAX@Z
_except_handler3
fclose
fopen
fwrite
sprintf
fscanf
__CxxFrameHandler
_CxxThrowException
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

winmm

timeGetTime

psapi

GetModuleFileNameExA

ws2_32

inet_addr

shlwapi

PathFindFileNameA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ