4e49b79f3b899c2f7670c0402e19d3a8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4e49b79f3b899c2f7670c0402e19d3a8
Size

170KB
MD5

4e49b79f3b899c2f7670c0402e19d3a8
SHA1

383c2ce14db7b4b8d7b7caa11859dae1a20ea96f
SHA256

dd2503cca3cdc24823297c5604d5293d1d6f5a1a776600304a34ab5821e01b01
SHA512

676e0cdd5a6279250e906c3a955e3dad7f774871408175d47f18e008d9ba209b59f5e85f34a9ca4cd99a3c1b2b6f0885616b4548cdd843d72bf671cd1a32bdfe
SSDEEP

3072:ack378UKa8Vo52vHbd8OESAT3kgnwwWVyOW0QyikCfJ2igWgqloSaNmT:ab3758u68OtKUgwwW7W0CB2ioKT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e49b79f3b899c2f7670c0402e19d3a8

Files

4e49b79f3b899c2f7670c0402e19d3a8
.exe windows:4 windows x86 arch:x86

f6ced02617181defbf7e17c76a9427b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

HlinkNavigateString

Sections

.text
Size: 23KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE