48f36d68fb45a9fd709204ba4cb94e30N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

48f36d68fb45a9fd709204ba4cb94e30N.exe
Size

7KB
MD5

48f36d68fb45a9fd709204ba4cb94e30
SHA1

66c7d8274349802b12ed6cdf7dc0f0085d3d815e
SHA256

44f7af01ecc9c505e628c84816d66978b73843db2d8c33b09e715f596ed26244
SHA512

df85e771baff05743c738c1e84eef8082bc48655552f6324df7085f1b67fe3ac4e82728709ebc561170443401023fbe0ee7f6543b6faea9800e23e99d4df3910
SSDEEP

48:aDv1qEqevmVglLXkPbIVwhMXrDhMveiJMwKMRuqSOB:QqevmVGgPkVwyDQeiJMwKsxr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48f36d68fb45a9fd709204ba4cb94e30N.exe

Files

48f36d68fb45a9fd709204ba4cb94e30N.exe
.dll windows:6 windows x86 arch:x86

514c6c98ada0bc59a07c38ac0cfc03ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

fwpuclnt

FwpmFilterEnum0
FwpmFilterDestroyEnumHandle0
FwpmFilterCreateEnumHandle0
FwpmEngineClose0
FwpmFreeMemory0
FwpmFilterDeleteById0
FwpmEngineOpen0

kernel32

GetModuleHandleA
DisableThreadLibraryCalls
GetProcAddress
VirtualProtect

Sections

.text
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ