49a807116923aa32f53e598cb654c394 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49a807116923aa32f53e598cb654c394
Size

22KB
MD5

49a807116923aa32f53e598cb654c394
SHA1

0c015a44bc3af6834ab07710304d575e47c650d0
SHA256

91f3b901ac76d35cd9ff70e29d877bccd9cc998ddb001477e9cb45a09fdb342a
SHA512

63ab0364fa9fe2184e7a5504a2b71ee6c6055c4f02f5f96f0aa742da3ab464cc41fe43619cefdca03f54ac357132a129527df3cb7e03d1a37e3bef03c9cc79e1
SSDEEP

384:JKuBy0YLtL5dF6ISERzEprAB8JyXBCExzo8SLw8QBJs5sIZcxpCpC0FTJ3qh:XyRtfBSERzE1OhC+XSLwA5tZKpKV3qh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49a807116923aa32f53e598cb654c394

Files

49a807116923aa32f53e598cb654c394
.dll windows:4 windows x86 arch:x86

f09abd934e5cb9b134cfdc55f1f0ca92

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

strcpy

Exports

Exports

input

Sections

.text
Size: 18KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE