49cf9012c61abb28388f6f850994380f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49cf9012c61abb28388f6f850994380f
Size

115KB
MD5

49cf9012c61abb28388f6f850994380f
SHA1

041d3c7136de0387dfee859285f14b9f5fa5a163
SHA256

3b64db921156979020203cbe13a15e96a79961e84e0ac1be5ecea80cd1cdef4a
SHA512

62f6f16087e589ddf506e8fd35929284fb027ed59e4db4e81177de170539d8845ac13bc1290c849c5d2e45e12b889e46017ca4106c2f01e759ef3f260eb18c38
SSDEEP

1536:svnppfjzTAyDWvxOSmRsOeslpUXDKMj3WW1DZyX4TDI3xF8blSk:svnppfjzTAyDWJOSKswpCB7CSIuz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49cf9012c61abb28388f6f850994380f

Files

49cf9012c61abb28388f6f850994380f
.exe windows:4 windows x86 arch:x86

8b54a587227642ebb3f1a47cd2770d25

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
VerFindFileA

shell32

SHGetFolderPathA
SHGetDiskFreeSpaceA
SHGetSpecialFolderLocation
SHGetFileInfoA
SHFileOperationA

shlwapi

SHQueryValueExA

gdi32

GetCurrentPositionEx
RestoreDC
GetRgnBox
CreatePalette
CreateDIBitmap
GetBitmapBits
CreateCompatibleBitmap

kernel32

GetVersion
MoveFileExA
GlobalAlloc
ExitThread
CreateThread
FormatMessageA
GetCommandLineA
lstrlenA
SetThreadLocale
GetModuleHandleA
GetEnvironmentStrings
GetProcAddress
GetStartupInfoA
CompareStringA
HeapDestroy
LocalReAlloc
GetFileType
VirtualAllocEx

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE