49f89fa832109fe5e783515af50f9faa

General

Target

49f89fa832109fe5e783515af50f9faa
Size

46KB
MD5

49f89fa832109fe5e783515af50f9faa
SHA1

caef632eccda0e067b0f1f14a3b902fd46b78b59
SHA256

6c26952d7f4cbf3dd559ed2d5f03423ea17f3dbd4415aa554ac9c191f6b2107c
SHA512

08e63e4f38a2b9d40a108e44c8a60188a2c55c1344756b6836fd256ec9bb299873e1d6838bfbbf7d3877fd4b52b325a8d264c2e1a9d9c0eddd8abd822728c7ca
SSDEEP

768:cFngyZei8zYTpo0dbvmwO2rY59nFsglQDK+eUIljhTTEG:ah98z2pnb2+mlQDheHVTt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49f89fa832109fe5e783515af50f9faa

Files

49f89fa832109fe5e783515af50f9faa
.exe windows:4 windows x86 arch:x86

8181764fab62f3373cd953deec0b9f18

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
FindResourceA
Sleep
CreateProcessA
SizeofResource
ExpandEnvironmentStringsA
GetModuleHandleA
GlobalFree
GlobalAlloc
CreateFileA
DeleteFileA
RemoveDirectoryA
WriteFile
FlushFileBuffers
FreeResource
GetTempFileNameA
CloseHandle
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetLastError
SetFilePointer
GetStdHandle
HeapFree
HeapAlloc
WideCharToMultiByte
GetProcAddress
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
SetStdHandle
VirtualFree
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
LCMapStringA
GetSystemInfo

advapi32

CreateServiceA
OpenServiceA
CloseServiceHandle
ControlService
DeleteService
StartServiceA
OpenSCManagerA

ws2_32

gethostname
gethostbyname
inet_ntoa
WSACleanup
WSAStartup

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 240KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8181764fab62f3373cd953deec0b9f18

Headers

File Characteristics

Imports

kernel32

advapi32

ws2_32

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 240KB - Virtual size: 237KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 240KB - Virtual size: 237KB