50517c8318b8408ecfa58032c02dfbb9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

50517c8318b8408ecfa58032c02dfbb9
Size

477KB
MD5

50517c8318b8408ecfa58032c02dfbb9
SHA1

713e9a9fe5460401de8f1a004098e06c204b2eb0
SHA256

c64a0a7b7c5f6e0ca250b0a2e53914fe499331477abe61c3190a1b05418149d8
SHA512

d7c1f9b6bbb170b247139529fab64889390e61738f3f3f4aa129842a49bb13e1cbc3305771112cdda1100a303b8b2c7fa51a96446a2bc73967b78242b582c753
SSDEEP

12288:9oH5Z+gCp/OT42W1wETriLn43afWQhJmnC/Kfsuq3JCw3M:9ev6cs2ETrsn32nVVqO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50517c8318b8408ecfa58032c02dfbb9

Files

50517c8318b8408ecfa58032c02dfbb9
.exe windows:5 windows x86 arch:x86

914fbd13e28047202926f3c27d5e3361

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strcmp
vsprintf
sprintf
memset
memcmp
_vsnprintf
strcpy
strlen
memcpy
_strcmpi
_snprintf
RtlRandom
strstr
_strlwr

kernel32

SetUnhandledExceptionFilter
GetWindowsDirectoryA
lstrcmpiA
IsBadReadPtr
HeapAlloc
GetProcessHeap
HeapFree
HeapValidate
GetCurrentProcessId
OutputDebugStringA
GetCurrentThreadId
GetLastError
ExitProcess
VirtualFree
VirtualAlloc
GetSystemInfo
LoadLibraryA
VirtualProtect
GetModuleFileNameA
GetProcAddress

user32

MessageBoxA

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ