549c3c1443958ea03172b6a4df28a875 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

549c3c1443958ea03172b6a4df28a875
Size

338KB
MD5

549c3c1443958ea03172b6a4df28a875
SHA1

c94bea527ee70d36cae6c8c513a41254c2a2605d
SHA256

3e4b7ee76f5899dec9b5134e951710ef7e236dd5018bbbf8c9b340c71e7da838
SHA512

44922cd66ba7221f2545ecf60686d9277f974a5a1aec876c89de79387afd0426fdb50b60ce5beb02c0786d3a2b0eba1acf1129dd4d0638e87b3dec7cf7d9a078
SSDEEP

6144:RJkIh0ThYrvUfcMqJJw5Org483f5MtcCeni13uuDNIt:ROU0VY/NJJw5ln5MtWni133It

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
549c3c1443958ea03172b6a4df28a875

Files

549c3c1443958ea03172b6a4df28a875
.exe windows:5 windows x86 arch:x86

5f2885af2882ebf166d6d963f86e4570

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

cfgmgr32

CM_Get_Depth_Ex

kernel32

GetTempPathA
TerminateProcess
GetModuleHandleW
GetCommandLineA
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
TerminateThread
CloseHandle
CreateThread
SetThreadPriority
Sleep
GetCurrentProcess
SetPriorityClass
SetErrorMode
GetCurrentThreadId
lstrlenA
lstrcmpiA
DeleteCriticalSection
InitializeCriticalSection
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA

ole32

CoInitialize
CoUninitialize
CoCreateGuid

shlwapi

SHGetThreadRef

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 803KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ