0c50b8ae3072c226e40525fcd3fbc1de | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c50b8ae3072c226e40525fcd3fbc1de
Size

46KB
MD5

0c50b8ae3072c226e40525fcd3fbc1de
SHA1

3a846067c2bfcff2e1f22906b406b8a4d8620304
SHA256

9f14867ddafc744c33a8225e8388c80b516a1708f70cbb58728b0925359f273a
SHA512

014224df8e3ae07d227185203d8390a8aafa09b04733576b48d23ba98eae464b2ee6e3caea99b39b1475d7494b23f49c59f6d1b6a6cb14fdb083cea0b4fdd872
SSDEEP

768:I6FUKYuEo8UVgpjb/23K6iAOmVD2AbEpqdniRPjSmiOoKHcnxizRcRh:IJo8UVkifiXIQptSXwMRh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c50b8ae3072c226e40525fcd3fbc1de

Files

0c50b8ae3072c226e40525fcd3fbc1de
.exe windows:5 windows x86 arch:x86

fb85e5a61e4c3ab1e466652805230ad5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueA
DuplicateTokenEx
CryptReleaseContext
RegQueryValueExA
CryptCreateHash
RegCloseKey
CryptGetHashParam
CryptDestroyHash

shlwapi

wvnsprintfA
PathCombineW
wnsprintfW
PathFindFileNameW
PathMatchSpecW
StrCmpNIW
StrStrW
PathRemoveFileSpecW
PathFileExistsW
SHDeleteKeyA
StrCmpNIA
wnsprintfA

Sections

.vwhct
Size: 36KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aherkx
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rqh
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ