4997881574993692d9ab076e36316c39 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4997881574993692d9ab076e36316c39
Size

151KB
MD5

4997881574993692d9ab076e36316c39
SHA1

883145337caf38e23974b55654dc3153cb206d55
SHA256

56a7e1640a638dd56f3eed6b68617ca46c17e7607ab9bc5735e950860d7572e5
SHA512

41f4ea78dde65538cf81e4ba1f2adcf5952b699924e934169fb2aac43d12abebc264d3f3de2251888ed671a367819e315ad51f9f647d9a0601a0f9de9de80d42
SSDEEP

3072:290piG4SaQEOBdsLDdQQWi+WuB5i3YrXw:xpihVQfX8dQQr+/w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4997881574993692d9ab076e36316c39

Files

4997881574993692d9ab076e36316c39
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ