4f4f565fc72e44b91b2db559058dcd96 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4f4f565fc72e44b91b2db559058dcd96
Size

40KB
MD5

4f4f565fc72e44b91b2db559058dcd96
SHA1

b2835033ee7926df4e843765d44a0ce138eb7fcc
SHA256

ad709134dc40e28e5c61ef6a89dc03ecd3a9d07383969a93e9207e099d5c6a24
SHA512

4265408c7934247eab4ec2203bc4e4d71c2e19386710ab8d04e9dab4681edd9265ab048f2c5a75e79cfaa253d8c7f80795ac573eafa11502a0d7bffecbe2ec80
SSDEEP

768:NnBsn7d0Sv4W6pM0PRLfN6YGqnkPgemBqTx2uX7iy6Ik:I0S9+L4YNkPNnGT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f4f565fc72e44b91b2db559058dcd96

Files

4f4f565fc72e44b91b2db559058dcd96
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

29496b9d4109b186ccbbba1cb0ddbc66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
UnmapViewOfFile
FlushViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
Sleep
DeleteFileA
TerminateProcess
OpenProcess
WinExec
GetCurrentProcessId
CopyFileA
GetTempFileNameA
GetTempPathA
GetWindowsDirectoryA
GetModuleFileNameA

shlwapi

PathFileExistsA

msvcrt

_onexit
__dllonexit
time
sprintf
_mbsupr
strcat
_ltoa
strlen
atoi
_except_handler3
_mbsrchr
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 310B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ