490e940b69ca9602dcf58554bbca500b | Triage

Sharing

General

Target

490e940b69ca9602dcf58554bbca500b
Size

139KB
MD5

490e940b69ca9602dcf58554bbca500b
SHA1

c46fb9db8a02bae54b5bdfa8d55a236a6e6a8542
SHA256

24d0b4ac5436e4379f25afb298bce3dbec42e06401791b7c32e3e26c185cfe4a
SHA512

783b303a5f889449d19198aec613331fd407d973be29a381e99c8a0133c67ff62f6b9b7b7f8ffb80edb3f0459a2a3a8ad1a1df661b7627c003303eae1fcc207a
SSDEEP

3072:+4yBRiHMt/psG2bTgAMi++5n5ekTEFjKHPh:+4yB8HMt/ab06V55eUOjKH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
490e940b69ca9602dcf58554bbca500b

Files

490e940b69ca9602dcf58554bbca500b
.exe windows:4 windows x86 arch:x86

3412d8a9332f98ca8ab1a826f1574c0a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceExA
ClearCommError
EnumResourceNamesA
DuplicateConsoleHandle
CreateNlsSecurityDescriptor
LZDone
GetModuleHandleW
SetCurrentDirectoryW
LoadModule
UnregisterWait
SetTapePosition

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 83KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE