50b1645c966f6fed47790484ccb9c1be | Triage

Sharing

Copy URL Twitter E-mail

General

Target

50b1645c966f6fed47790484ccb9c1be
Size

403KB
MD5

50b1645c966f6fed47790484ccb9c1be
SHA1

db8f5131cc07c5fa102f1fffa318d55454a49b10
SHA256

b945a545a1e6e10821d9cfe561b3228e9cf0d9e24108549a54f62513a76afc67
SHA512

a58d4c2315c61378c02e44b6a209548e83afe9debf9b296b2361b1f165050aad8b34f4fbe5bed013183176c87f12f806bcf43d312661e43496b7468a08c40914
SSDEEP

6144:75K+vqK2+cZVhW1dIBW9bjPD51s2NKTIfW3ZoTmy4Tu2Y2Z3GXT:t2+cZVlBW9D5F4Zot/2J3GXT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50b1645c966f6fed47790484ccb9c1be

Files

50b1645c966f6fed47790484ccb9c1be
.exe windows:5 windows x86 arch:x86

d0f46f235d1fe897ed3fd3648a1edf89

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

advapi32

CryptAcquireContextW
CryptDestroyHash
CryptHashData
GetUserNameW
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA

shlwapi

PathCombineW
PathMatchSpecW
PathRemoveFileSpecW
StrStrW
wnsprintfA
wnsprintfW
wvnsprintfA
wvnsprintfW

user32

CharLowerBuffA
GetIconInfo
GetKeyState
GetMenuItemID
PeekMessageA
ToUnicode

Sections

.nqd
Size: 41KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yrsh
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xql
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ