50540f4edcfe0b04575f2c260dd13d40

Sharing

Copy URL

Twitter E-mail

General

Target

50540f4edcfe0b04575f2c260dd13d40
Size

50KB
MD5

50540f4edcfe0b04575f2c260dd13d40
SHA1

45319214b361999bd51f741601255a272d7a9c10
SHA256

e05624e588c677dbd09e6c285412abb23eed480ca8fdbe165d354df2dd7b50c2
SHA512

752c2a7e3d328b1e6c6e37ab83dd7583f27ae764fcf65920c427868c71138358d603d2ec22ea5ffd30ef74fceddb542ee96624618a1eeccd41eaac9a0a30c589
SSDEEP

1536:h/6dlQZgFQYKTm5saVZR2HkChHx14AgIZ:wliQQpTMZcH1Riba

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50540f4edcfe0b04575f2c260dd13d40

Files

50540f4edcfe0b04575f2c260dd13d40
.exe windows:1 windows x86 arch:x86

5898d8b74a596cff3f24b0fca836a5fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFolderPathA
ShellExecuteEx

ws2_32

htons
gethostname
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
send
socket
WSAIoctl

advapi32

RegEnumKeyExA
StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
DeleteService
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges

crypt32

CryptUnprotectData

gdi32

GetDeviceCaps

kernel32

Sleep
SetProcessPriorityBoost
WideCharToMultiByte
UnmapViewOfFile
lstrlenW
CloseHandle
lstrlen
lstrcpyn
lstrcpy
lstrcmpi
lstrcmp
lstrcat
SetPriorityClass
SetErrorMode
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateFileMappingA
CreateFileA
CopyFileA
WriteFile

ole32

CreateStreamOnHGlobal
CoTaskMemFree

psapi

GetModuleFileNameExA
EnumProcesses
EnumProcessModules

rasapi32

RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA

shlwapi

StrChrA
PathFileExistsA
StrStrIA
StrRChrA
StrCmpNA

user32

GetDlgCtrlID
ReleaseDC
GetDC
FindWindowExA
SetActiveWindow
wsprintfA
FindWindowA
SendMessageA

wininet

InternetGetConnectedState

Sections

.text
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Windows
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5898d8b74a596cff3f24b0fca836a5fa

Headers

File Characteristics

Imports

shell32

ws2_32

advapi32

crypt32

gdi32

kernel32

ole32

psapi

rasapi32

shlwapi

user32

wininet

Sections

.text Size: 32KB - Virtual size: 36KB

.rdata Size: 3KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 192KB

.xdata Size: 4KB - Virtual size: 4KB

Windows Size: 512B - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 36KB

.rdata
Size: 3KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 192KB

.xdata
Size: 4KB - Virtual size: 4KB

Windows
Size: 512B - Virtual size: 4KB