50f59882252e77ba56c08b5f08ba5afe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

50f59882252e77ba56c08b5f08ba5afe
Size

24KB
MD5

50f59882252e77ba56c08b5f08ba5afe
SHA1

2a1f47e40edc33a4b277242268b8906b2b0392ab
SHA256

6f40464e6044e06dcc001d3acd16a93aaeea864c70aff6e8d88e95f26a97493d
SHA512

a36f6ef65c0869c6f1a72952e081548746039903e9f883d74561337db92cd786d3e04efaef3a7b4d69d8a09ca7040f4dd4275d7888b52106f4323ba0f00f7cf7
SSDEEP

384:ggu0LZ5qgIPSjOJzG73OrEg5E2t5GnGX:gz2jso6zGwEga2t5GnG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50f59882252e77ba56c08b5f08ba5afe

Files

50f59882252e77ba56c08b5f08ba5afe
.dll windows:4 windows x86 arch:x86

0bdeef1bfd5c5084d3edcc94177f03cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetClassNameA
GetWindowThreadProcessId
EnumWindows
EnumChildWindows
SetForegroundWindow
GetWindowTextA
SetWindowTextA

msvcrt

malloc
_adjust_fdiv
_strupr
free
atoi
memcpy
strchr
strcmp
strstr
fopen
fwrite
fclose
fread
time
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
_strlwr
_itoa
_initterm

kernel32

CreateEventA
Sleep
LoadLibraryA
WaitForSingleObject
ExitProcess
TerminateProcess
GetCommandLineA
GetProcAddress
GetModuleFileNameA
CreateThread
GetTempPathA
SetEvent
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
lstrcmpA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 974B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ