b50b1918f070da6b929fe1253a5e789f | Triage

Sharing

General

Target

b50b1918f070da6b929fe1253a5e789f
Size

144KB
MD5

b50b1918f070da6b929fe1253a5e789f
SHA1

7ca6fceba761cadc9293df522901675fc1eebccc
SHA256

77f78f7bce3fecdd94c42a3d3c336f7e0ad11bdfa5be7f861232dff3e54df172
SHA512

2dc46adba274713351e3756b50e3f26d137408f05eb4c075f299b7cf61e2e0df8bf038f166eb0960658fde0ebb4f97739661dd1732ea12bc030697b74b30a178
SSDEEP

3072:y6/Hw36clgmea3+PqAFLqM2nGKj0nnymGq:y+HwRB3sv5yhq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b50b1918f070da6b929fe1253a5e789f

Files

b50b1918f070da6b929fe1253a5e789f
.exe windows:4 windows x86 arch:x86

80517ad3e854d9fa9124478207959a03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
CreateEventA
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryA
GetCurrentThread
GetProcAddress
LoadLibraryA
VirtualProtect
LockResource
GetSystemDirectoryA
FindResourceA
LocalFree
GetStdHandle
ExitProcess
GetWindowsDirectoryA
GetCurrentThreadId
VirtualAlloc
GetComputerNameA
LocalAlloc
LoadResource
GetVersionExA

advapi32

GetUserNameA

user32

GetActiveWindow
GetForegroundWindow
GetSystemMetrics

msvcrt

memcpy
memset
wcslen
wcsncpy

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ