492206c9701421ef47ec91015ebbf506 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

492206c9701421ef47ec91015ebbf506
Size

49KB
MD5

492206c9701421ef47ec91015ebbf506
SHA1

eccb97b76b12b098819ee9df4110c9fe6290d864
SHA256

89e4ddfc9b62118f7fec97e2355aa911e397e2548b086d0d68dfb4a381703d13
SHA512

136bce6dfd2d3b62bf367755c211a105f0a41f5dff5c6ec55ea6993c6d6aae8d8d09fea224498312b544a00d7998de4b764f21ed14deb5460e3bb254e7ef798f
SSDEEP

768:mGBwUThWeJYG196DwXISoNRNLJM/V3e7wZ3gOnza1ZTfKl8BS0Z2L2KPy0xVjv:5iUd9uGbCwGHb7wh3a1ZbKnL/VD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
492206c9701421ef47ec91015ebbf506

Files

492206c9701421ef47ec91015ebbf506
.exe windows:5 windows x86 arch:x86

49e7dc3bd9d951e7066087ce5c256e1f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

wvnsprintfW
wvnsprintfA
PathMatchSpecW
PathFindFileNameW
StrCmpNIA
PathFileExistsW
wnsprintfW
StrCmpNIW
SHDeleteKeyA
PathRemoveFileSpecW
PathCombineW
wnsprintfA
StrStrW

advapi32

DuplicateTokenEx
CryptReleaseContext
CryptCreateHash
RegDeleteValueA
RegCloseKey
CryptGetHashParam
RegQueryValueExA

Sections

.yvebst
Size: 39KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rgban
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bankl
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ