49f994580b7f4893bf232d145b58cb78

General

Target

49f994580b7f4893bf232d145b58cb78
Size

393KB
MD5

49f994580b7f4893bf232d145b58cb78
SHA1

a555f0e0a552fd8c11b0700f04cf306fc5b56147
SHA256

920d5778cddeb30268f1ad1b016b21458272b719512e169d5a48c658c0a265c2
SHA512

89c67ee2202fac5716598b4f2e1aa4467daf66e06c1c6b4ab1d14c008654ca4b3b149dcccaf167388f4085737d0ccf3a3d29f48d6d561f786fcde68197570e1c
SSDEEP

12288:42ReX8YrszIuCN96ngTjVmewkFVAaaksefzNJyDiKKxqDyYp:0t/4sseNEif82

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49f994580b7f4893bf232d145b58cb78

Files

49f994580b7f4893bf232d145b58cb78
.exe windows:4 windows x86 arch:x86

678c54cfabdb2e28757f192c70722b97

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualQuery
SetThreadIdealProcessor
GetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcess
HeapAlloc
LoadLibraryA
OpenFileMappingA
ExitProcess
VirtualAlloc
CopyFileExA
FindNextFileA
GetSystemTimeAsFileTime
InterlockedExchange
GetTickCount
GetCurrentProcessId
GetModuleHandleA
HeapFree
GetProcAddress
RtlUnwind
TerminateProcess
GetModuleFileNameA
HeapReAlloc
TlsSetValue

advapi32

RegEnumKeyExW
LookupPrivilegeNameW
CryptEnumProvidersA
RegEnumKeyW
LookupPrivilegeDisplayNameW
RegOpenKeyExW
GetUserNameW
CryptHashSessionKey
RegReplaceKeyA
LookupAccountNameW
RegNotifyChangeKeyValue
RegConnectRegistryW
CryptSetProviderA
CryptDecrypt
CryptDuplicateHash
RegRestoreKeyA
RegOpenKeyW

shell32

ExtractIconEx
SHFileOperationA
SheGetDirA
DragFinish
RealShellExecuteExA
SHGetFileInfoW
SheChangeDirExW
SHGetDesktopFolder
SHGetFileInfo
ShellAboutW
SHGetSpecialFolderPathW
SHFreeNameMappings
SHFormatDrive
SHBrowseForFolderW
ShellExecuteExW
SHGetDataFromIDListW
ExtractIconExW
ShellExecuteEx
DragQueryFile

wininet

GetUrlCacheConfigInfoA
FtpDeleteFileW
InternetShowSecurityInfoByURLA
GopherFindFirstFileA
IsUrlCacheEntryExpiredA
InternetDialA
FreeUrlCacheSpaceW
InternetOpenUrlA
GopherCreateLocatorA
InternetCrackUrlA
FtpGetFileW
FindFirstUrlCacheContainerA

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

678c54cfabdb2e28757f192c70722b97

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

wininet

Sections

.text Size: 119KB - Virtual size: 118KB

.data Size: 264KB - Virtual size: 263KB

.rsrc Size: 9KB - Virtual size: 9KB

.text
Size: 119KB - Virtual size: 118KB

.data
Size: 264KB - Virtual size: 263KB

.rsrc
Size: 9KB - Virtual size: 9KB