48af126d0a99dca0e952323716a54eff | Triage

Sharing

Copy URL Twitter E-mail

General

Target

48af126d0a99dca0e952323716a54eff
Size

121KB
MD5

48af126d0a99dca0e952323716a54eff
SHA1

2fc60f99882e1622c81af41b20ae0a7bd6470bc6
SHA256

c64d1040fb9f17364fca0294571c382b979f31d56cc6f68f0881fa0b9dbe6e20
SHA512

92e18b7cc1bcd3e6dd9a7eb9d15a3ee6581dd832871493a6887a64f9de61d37438cf333e7e999ebb37385081c45abcccec34913fd1d2cfbad92c4e44412068f3
SSDEEP

3072:5SvtRZyxTztWFVWeYKfciOWVt7XaGhRV3or35bxviP3:qlyBtWlYKfluGd3ozfiP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48af126d0a99dca0e952323716a54eff

Files

48af126d0a99dca0e952323716a54eff
.exe windows:4 windows x86 arch:x86

4501f0f4bcc646a898d54d563cbe3707

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
VirtualProtectEx
LoadLibraryA
ExitProcess
GetLastError
OpenThread
GetThreadContext

user32

PostMessageA
IsChild

Exports

Exports

OpenKcciyji
Bgajkqojo

Sections

.text
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DATA2
Size: 3KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 109KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enill
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ