49ac8a495dc53a57a12645bb848fe5549854f90147ff6632c2f28345632b0dfd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49ac8a495dc53a57a12645bb848fe5549854f90147ff6632c2f28345632b0dfd
Size

241KB
MD5

1748ca6a121a29ff78e45d15a7984751
SHA1

cf833fc05d285d867fdba0825cb67fa4e30c3c9f
SHA256

49ac8a495dc53a57a12645bb848fe5549854f90147ff6632c2f28345632b0dfd
SHA512

b82146df696e59093557b49a7ee641b103ba8ce90d2be3d91e36933cd7e1452fcf8a9fb50963287c3946d83a2b4a870a56f755075bc92c7f43f46174dd5b9cf6
SSDEEP

6144:AU4CdnsOQYLPkCfTmZ4cKvIUCAgvFL86c8dkVSL:3rdseDcyIRAGFA6cC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49ac8a495dc53a57a12645bb848fe5549854f90147ff6632c2f28345632b0dfd

Files

49ac8a495dc53a57a12645bb848fe5549854f90147ff6632c2f28345632b0dfd
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\PMS\_AUpdate\HanCapture\bin\Release\Agent.pdb

Sections

.text
Size: 211KB - Virtual size: 692KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE