50624918c4c3d3c7bdc7faf9410519c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

50624918c4c3d3c7bdc7faf9410519c0N.exe
Size

339KB
MD5

50624918c4c3d3c7bdc7faf9410519c0
SHA1

74b46d8db0254f466a56a65c85768dd890747640
SHA256

7fb6ae14a85f5ea3aacdc5900695650313db041cd0fd0637845febedf020fda8
SHA512

2e464bd02d14e50c90c88c867e3e14c4e890f014f54c70b12b7893cd7d7e2280f396f53abc6c63a2941ab8ea135f99775920a92a9c4f97ec16306413b72e01bd
SSDEEP

6144:boyF3WWPHxc1Ft7E/V6ntqa0106xPbIW0ewt137goa:TFGisFtptqaKZV8W09ba

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50624918c4c3d3c7bdc7faf9410519c0N.exe

Files

50624918c4c3d3c7bdc7faf9410519c0N.exe
.dll .pdf windows:6 windows x86 arch:x86 polyglot

45409799ef67da619a0cc6f27dcde8e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\mso\x-none\exp_pdf.pdb

Imports

msvcr100

_invalid_parameter_noinfo_noreturn
memcpy
__CxxFrameHandler3
_CIsin
_CIcos
_vsnprintf_s
sprintf_s
_snprintf_s
memmove
wcsnlen
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
strncpy_s
strncat_s
strnlen
strcpy_s
wcsncpy_s
memset
rand

advapi32

CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptGetHashParam
CryptImportKey
CryptEncrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW

gdi32

DeleteObject
GetCharWidth32A
GetGlyphOutlineA
GetOutlineTextMetricsA
GetTextAlign
GetTextExtentPointA
GetGlyphIndicesW
GetCharWidthI
SelectObject
SetTextAlign
CombineTransform

gdiplus

GdipGetPointCount
GdipGetPathTypes
GdipGetPathPoints
GdipGetPathFillMode
GdipGetPathWorldBounds
GdipCreateMatrix3
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipGetMatrixElements
GdipDeleteMatrix

kernel32

GetProcessHeap
QueryPerformanceCounter
DisableThreadLibraryCalls
HeapSetInformation
GetTimeZoneInformation
FileTimeToSystemTime
MoveFileExW
GetLastError
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
VirtualProtect
WerRegisterMemoryBlock
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalAlloc
GetProcAddress
FreeLibrary
LoadLibraryA
WriteFile
DeleteFileW
CloseHandle
SetFilePointer
ReadFile
GetFileInformationByHandle
GetFileAttributesExW
RaiseException

rpcrt4

UuidCreate

mso

ord302
ord252
ord5276
ord4454
ord1530
ord7488
ord9730
ord9064
ord9584
ord5541
ord2766
ord7285
ord5467
ord3735
ord8953
ord3500
ord3786
ord491
ord2024
ord6705
ord4606
ord1133
ord7612
ord6125
ord9462
ord8879
ord3278
ord4602
ord9362

Exports

Exports

HrGetDocExDocument

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 238KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45409799ef67da619a0cc6f27dcde8e1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

advapi32

gdi32

gdiplus

kernel32

rpcrt4

mso

Exports

Exports

Sections

.text Size: 98KB - Virtual size: 97KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 238KB - Virtual size: 240KB

.text
Size: 98KB - Virtual size: 97KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 238KB - Virtual size: 240KB