44dda79d57cab147763821a8b7538921 | Triage

Sharing

General

Target

44dda79d57cab147763821a8b7538921
Size

288KB
MD5

44dda79d57cab147763821a8b7538921
SHA1

f0b7aa5c86c0d422e08879c847964deb6b4e283d
SHA256

85119c7398f8c0e4eba8eeb5e6faeeb2d5951dfb87e4d7bb3f68157acc31bb7f
SHA512

5f26ad91ccb1f9d00c50df37ed2bbaa28ca4ed1924b88be15987ccc0cf052f6b58518491c3bec7c4074c128e483be4a1a7059f2404bce423329a297ffbfaf0b2
SSDEEP

6144:qd+kUXo2jyeq7EXtBqIE4+WnYAmpYesrsqbkhXyVvO7C1cwPh5HWAAr6LkQV6MHa:qTGo2jygX6B4+k33g5yw7CSoh52drOkj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

44dda79d57cab147763821a8b7538921

Files

44dda79d57cab147763821a8b7538921
.exe windows:4 windows x86 arch:x86

2f1c53b25e261b1ea9fce8132bb466c5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
VirtualAlloc
VirtualFree
OpenMutexW
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
HeapSize
HeapDestroy
GetVersionExA
FreeLibrary
LoadLibraryW
GetProcAddress
GetCurrentThreadId
GetLastError
LocalFree
GetVersionExW
HeapFree
HeapReAlloc
HeapAlloc
FindResourceExW
FindResourceW

oleaut32

OleSavePictureFile
OleCreatePropertyFrame
SafeArrayGetIID
SysReAllocStringLen
OleLoadPictureFileEx
CreateTypeLib
OleLoadPictureFile

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 193KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 286B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ