49849bd4e97248dacf85fffdaa9e3cd1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49849bd4e97248dacf85fffdaa9e3cd1
Size

15KB
MD5

49849bd4e97248dacf85fffdaa9e3cd1
SHA1

79d6df6db657ca711f5a6235880a3fa76e455b00
SHA256

c6164f8c19bde464a33e38743dc777aff80e6a2be8aa3235b9b7ccae3fe119ab
SHA512

53428a18291feb15841209f07617bdba2e6c82cb9454402cd3bf25431b102a0acce52ff05da3351680839be80c7cd8fffefe7c6370c58c4c57b1363980f2891d
SSDEEP

384:HX/CT47n714OpwcIFha+66olLIYWYdCYYaJ1U:HPRlPpwcSMPZtAao

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49849bd4e97248dacf85fffdaa9e3cd1

Files

49849bd4e97248dacf85fffdaa9e3cd1
.exe windows:4 windows x86 arch:x86

99b0126bde51d55b239acc25efcea865

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
LocalFree
DeleteCriticalSection
lstrcpyA
HeapAlloc
GetACP
GetOEMCP
InterlockedExchange
GetCommandLineW
SetConsoleCP
GetModuleHandleA
VirtualProtect
SetStdHandle
TlsAlloc
GetStdHandle
GetStartupInfoA
ExitProcess

user32

SetCursor
PeekMessageA
GetNextDlgTabItem

rpcrt4

I_RpcBCacheFree

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE