49e5d173ca444f5f54637fea72328238[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

49e5d173ca444f5f54637fea72328238.exe
Size

855KB
MD5

49e5d173ca444f5f54637fea72328238
SHA1

8222bb2340ed869f14e5a0515edce36b900ac235
SHA256

401412b8eedb1b25cec30b49050c7502b4add8d7008e0d97d19372b4fbdd9f23
SHA512

4c9a4d8b4c3c311a4e5053779cd4ce8cc118989d7ddf302d4b9e2bd11dbb06caf6957cb8412fdefbe911c8de5ef7a6371018ae6c4b08ce94b43d660f278e3e5a
SSDEEP

12288:0cC/Xv6TAEKTXy90WJspkG3XZt2fbhVtwRH9Z0bl11QUjDQLSwO:07Xv6UEt9vspkyZmtwUjDI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49e5d173ca444f5f54637fea72328238.exe

Files

49e5d173ca444f5f54637fea72328238.exe
.exe windows:6 windows x86 arch:x86

b87fc3874fae7c2c4ec39758e7ba8890

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\удача\Desktop\StubClear\Release\BigProject.pdb

Imports

kernel32

K32EnumProcessModulesEx
CreateFileW
K32EnumProcessModules
K32EnumProcesses
LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
GetCurrentProcessId
GetCurrentProcess
CloseHandle
K32GetModuleBaseNameW
HeapSize
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetFileType
HeapAlloc
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
TerminateProcess
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
WriteConsoleW

comdlg32

CommDlgExtendedError
PrintDlgA
ChooseFontA
ReplaceTextW
ReplaceTextA
FindTextW
FindTextA
ChooseColorW
ChooseColorA
GetFileTitleW
GetFileTitleA
GetSaveFileNameW
GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA

rpcrt4

UuidToStringW
RpcEpRegisterNoReplaceA
RpcMgmtWaitServerListen
RpcMgmtStopServerListening
UuidFromStringA
UuidToStringA
RpcBindingFree
RpcBindingFromStringBindingA
RpcBindingReset
RpcStringBindingComposeA
RpcStringFreeA
RpcStringFreeW
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpA
UuidCreate

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoSizeExW
VerQueryValueW

shlwapi

PathRemoveFileSpecA
PathAppendA
PathFileExistsA
PathFindFileNameA
PathIsURLA
PathAddBackslashA

Sections

.text
Size: 390KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 398KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b87fc3874fae7c2c4ec39758e7ba8890

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

comdlg32

rpcrt4

wintrust

version

shlwapi

Sections

.text Size: 390KB - Virtual size: 390KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 398KB - Virtual size: 407KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 390KB - Virtual size: 390KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 398KB - Virtual size: 407KB

.reloc
Size: 9KB - Virtual size: 9KB