f50296cd6845b4ebdf74b36d26dca063444b7175bb01502c9525762887e31963 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f50296cd6845b4ebdf74b36d26dca063444b7175bb01502c9525762887e31963
Size

63KB
MD5

4db72ade3fe8d55579703e9fc9c0db78
SHA1

76c609fcbcd107b7dc34f8e30fe6dcfab791e007
SHA256

f50296cd6845b4ebdf74b36d26dca063444b7175bb01502c9525762887e31963
SHA512

652481ec17145e4dde4365464bf2b3df76bcd217c141cda7c2721358632b7a5c17881c030df3bafaa22562c560474cf60e2674c0e912323a3c253a4e491a5f73
SSDEEP

1536:awBAEnp8M7oiKAGpAkv8p+ra+INwC2LrAhGG3itE6ODe9KNWy26:huSW6oiMFm8hFGStweQNWX6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f50296cd6845b4ebdf74b36d26dca063444b7175bb01502c9525762887e31963

Files

f50296cd6845b4ebdf74b36d26dca063444b7175bb01502c9525762887e31963
.exe windows:4 windows x86 arch:x86

c26e504f0816b7fa5abf7f5aa85307f8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileNameTransactedW
IsBadCodePtr
AddConsoleAliasA
BaseWriteErrorElevationRequiredEvent
InterlockedFlushSList
ActivateActCtx
GetSystemFileCacheSize
CheckElevation
IsWow64Process2
EnumResourceLanguagesA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE