49b2034cf7fcf0cd5eead4941e2a57e9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49b2034cf7fcf0cd5eead4941e2a57e9
Size

100KB
MD5

49b2034cf7fcf0cd5eead4941e2a57e9
SHA1

1a823e49218a51662e7df353d5323a203271deb6
SHA256

9e34a6120ef7460f3bc3b57a2a88f932daab4f8ba6e88dda18da659631998578
SHA512

542c2688c14a2dc420c4565ec0386695f50974e017e5caeece3b02053c01216889da8ecf0970a9eba555cc081a315fab3840e7b50ea400d71895c766afacf1da
SSDEEP

3072:p3RA+RNSR8d10j6aBIx6pYQ9eYNkFpi133QOu:p3R5R28d1WIx6+QAYZ3QOu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49b2034cf7fcf0cd5eead4941e2a57e9

Files

49b2034cf7fcf0cd5eead4941e2a57e9
.exe windows:4 windows x86 arch:x86

de6fdcdc7f4ad649a7529bf91b3c3b02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

ws2_32

WSCInstallProvider

Sections

.code
Size: 95KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE