0a4b50e51c633dd177821bb8662c8b76de8fc0d5d9b50846b1ac3fd1e749c467 | Triage

Sharing

General

Target

0a4b50e51c633dd177821bb8662c8b76de8fc0d5d9b50846b1ac3fd1e749c467
Size

278KB
MD5

3c90c04e5d8039132797b8ff2cc5ba4e
SHA1

f7a8279383da93729efe498a5c4a840ebee396c3
SHA256

0a4b50e51c633dd177821bb8662c8b76de8fc0d5d9b50846b1ac3fd1e749c467
SHA512

962dc3edc31e0c219fae7f39af460bcb3d6c85af1bdf75bf0a7912ba951e7ba9a2d5d8df8baa095cf5caae77496467b312c16e463d196f7ed79d2dc252ea4f2c
SSDEEP

6144:jn5V/TLgOnNvGFWz3SW9Wv1ZwjKIzyQb01RTcM:H/vgavGFWz3SMu4jpfbNM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a4b50e51c633dd177821bb8662c8b76de8fc0d5d9b50846b1ac3fd1e749c467

Files

0a4b50e51c633dd177821bb8662c8b76de8fc0d5d9b50846b1ac3fd1e749c467
.exe windows:1 windows x86 arch:x86

fc6ca6ef68c395ad95364c82a30d5976

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
GetDiskFreeSpaceExW
CloseHandle
GetCurrentProcess
GetModuleHandleA
GetLastError
CreateFileW
LocalFree
FormatMessageW

crtdll

__GetMainArgs
exit
raise
signal

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ulib

?QueryDirectory@SYSTEM@@SGPAVFSN_DIRECTORY@@PBVPATH@@E@Z
??0DSTRING@@QAE@XZ
??0PATH@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??1PROGRAM@@UAE@XZ
??1PATH_ARGUMENT@@UAE@XZ
?ValidateVersion@PROGRAM@@UBEXKK@Z
?Usage@PROGRAM@@UBEXXZ
?GetStandardError@PROGRAM@@UAEPAVSTREAM@@XZ
?GetStandardInput@PROGRAM@@UAEPAVSTREAM@@XZ

ntdll

RtlFreeHeap
RtlAllocateHeap

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ