49054861b82ca36cd4b834dd7529a8e0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49054861b82ca36cd4b834dd7529a8e0
Size

6KB
MD5

49054861b82ca36cd4b834dd7529a8e0
SHA1

4e333e66f353fb25af2edff7d42dfa71fe3be279
SHA256

defa026ab26d4d44373b66574988c21df8f25f9000a96fa1b8ee7a0a4eea2d53
SHA512

641ff16b78ca314d68157cfc212e5950abd1b2534b97bcddc1b7d2686bc6c806a1baf97500e5703c9923a91f35bf971b082a8533e858a22ffc8b003ef385a718
SSDEEP

96:AQvf20Csz3rKEhVkf4XgM3fFKdja918CyPsZeN7/K4hd9x0/:AgfDfLeGfFKdKcP6eN779x0/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49054861b82ca36cd4b834dd7529a8e0

Files

49054861b82ca36cd4b834dd7529a8e0
.exe windows:4 windows x86 arch:x86

9fa41863167b4ce6a2b750dc5cf7f84a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
lstrcpyA
GetModuleFileNameA
lstrcatA
WaitForSingleObject
CompareStringA
ExitProcess
GetModuleHandleA
GetProcAddress
CreateEventA
LoadLibraryA
Process32First
CreateToolhelp32Snapshot
RtlUnwind

user32

IsWindow
CloseWindow

advapi32

RegCloseKey

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 862B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE