48629eea8061e67107808e8bdb4056b8 | Triage

Sharing

General

Target

48629eea8061e67107808e8bdb4056b8
Size

64KB
MD5

48629eea8061e67107808e8bdb4056b8
SHA1

051fa920a2c9c2da769be4cfc82cd9e9aed4bec2
SHA256

d088162ca45ae866a0836511de16e60f5af0fa9848b79c6ce1a98fc16f6b32d4
SHA512

2fa56753643db0967012fce3795d4a06cda6ab44b13d8aa67806e988cd3f14ca72bace9c7d0cc3b6413da6b847f85754d903b0c8b7e3fbf257195959b8eacc91
SSDEEP

768:sMh+BsQw9DEXsqm8nr/1u18g1AQQjNLnPzwJqQXtebVGtOz:dLDtqm8rNUIJnPzfQttOz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48629eea8061e67107808e8bdb4056b8

Files

48629eea8061e67107808e8bdb4056b8
.exe windows:4 windows x86 arch:x86

aee6b7fb0174b6481a856b9318b18628

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
LoadLibraryA
GetProcAddress
GetVersionExA
FreeLibrary
CloseHandle
GetLastError
HeapFree
OpenProcess
SetLastError
lstrcatA
lstrlenA
GetCurrentThread
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsSetValue
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
LeaveCriticalSection
EnterCriticalSection
Sleep
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSection

user32

wsprintfA

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ