4fd56045477d0ae739a14d35c2eeba14 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4fd56045477d0ae739a14d35c2eeba14
Size

923KB
MD5

4fd56045477d0ae739a14d35c2eeba14
SHA1

d24cbdff9b639f9ab6451365d85761698832b608
SHA256

a2623c19a13393c62f836b009a60988ebaac0a5410a2e36dfaf6ad9d560d30d7
SHA512

5a075f2ef2ab1eae2624c233016dbf2e6f9b64be3c7f54d5271178a3371bbb36370e8edf23f9ddbc40b8c082bae97164eb7f2a6f2b458f7a733f0c17f061bfb7
SSDEEP

24576:sZ+t9Y/pZd3zS5qA/nup2VXRLCmycnaahE/p:s4Sr3zS5vva2Vs7Oaa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fd56045477d0ae739a14d35c2eeba14

Files

4fd56045477d0ae739a14d35c2eeba14
.exe windows:4 windows

71eceadaaa4b89b470b39baec960ebe4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

wininet

DeleteUrlCacheEntry

urlmon

URLDownloadToFileW

shell32

SHGetSpecialFolderLocation

netapi32

Netbios

wsock32

WSACleanup

ntdll

RtlGetNtVersionNumbers

rpcrt4

UuidCreateSequential

Sections

CODE
Size: 912KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE