50c1a35c41dca7ad2cca14618b6f1bfb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

50c1a35c41dca7ad2cca14618b6f1bfb
Size

92KB
MD5

50c1a35c41dca7ad2cca14618b6f1bfb
SHA1

bba8b994269d891274ea42d1fe2deafb7962988e
SHA256

d488cb9e65b6b5e125b14595d4cfb693f4a04f27156f96668fa2799275bdc060
SHA512

6ad3e7e08e0b33ff43d4e2ca230570b3b60bbff097d19cac262c654343befdf8d57d3d5dae6421bbc0094ffbe34194e5b2057e21a81dbc6f9cbb210e5f402594
SSDEEP

1536:TW/oh7Gbdf+Nobor/JvDfAwwcc7Si9ZFImcyMgdSOj6IXN:2oh74hboT9TAwCei9ENJYSOFX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50c1a35c41dca7ad2cca14618b6f1bfb

Files

50c1a35c41dca7ad2cca14618b6f1bfb
.exe windows:4 windows x86 arch:x86

e1b5b660541ec39818a6feb014cb5d56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
SuspendThread
TlsFree
TlsAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetVersionExA
SetSystemTime
GetProfileStringA
SetConsoleCursorPosition
RegisterConsoleIME
SetFileAttributesA
EnterCriticalSection
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

ZwLoadKey
wcsncpy
NtOpenEvent
isdigit
ZwFlushKey

Sections

.edata
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

WEIjunLI
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ