497bfb3ce839cbb383e8406a9339d380N[.]exe | Triage

Sharing

General

Target

497bfb3ce839cbb383e8406a9339d380N.exe
Size

212KB
MD5

497bfb3ce839cbb383e8406a9339d380
SHA1

3996530c69d01970b6d5dbe93f46e5b5cfc97f7a
SHA256

3d4e0344ed12247a3f3bf305c3c642256797ae9a7cf8dd7a5f706ba316f903d9
SHA512

b5a944d104a1600b0d1ff203b5d3608a5e1e8761e08552c65963ce2f406c3f9e120702452f2828b36386d3e7ae703afa76573f0847fe33302c553b65827828c5
SSDEEP

3072:Ia1aBUnX2yjdTGun7UuEqhDDCMkIPgQplz6MpBAKsZ3X52yqYua1:j0ejUrv2vJgcV6NV3X52yqYua1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
497bfb3ce839cbb383e8406a9339d380N.exe

Files

497bfb3ce839cbb383e8406a9339d380N.exe
.dll windows:4 windows x86 arch:x86

9c515bf5a55140d6ed38567bb55f42d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
DisableThreadLibraryCalls

msvcrt

sprintf
malloc
getenv
fclose
strchr
fgets
fopen
_errno
_findfirst
_findclose
_findnext
strpbrk
_mbschr
_mbscmp
fprintf
exit
_pctype
_isctype
__mb_cur_max
atoi
free
tolower
realloc
_ftol
fread
strerror
fputs
_mbsrchr
strtod
fscanf
memmove
fwrite
strncpy
_pclose
_iob
_popen
sscanf
getc
_initterm
_adjust_fdiv
strstr
_strdup
_stricmp
_strnicmp
_mkdir
_fdopen
_write
_close
_open
_lseek

Exports

Exports

DvdAuthorMain
GetCurAuthFile
GetCurSect

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE