49cb0a48f8ce7be29e3c8b82c39d6d80N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

49cb0a48f8ce7be29e3c8b82c39d6d80N.exe
Size

1.3MB
MD5

49cb0a48f8ce7be29e3c8b82c39d6d80
SHA1

81bed06f3516e78d2f45a5a1d8419ea23228f4ad
SHA256

2c4dcebf73e64d0d3768d835cf534789f174ba610d79e243030a21e85008e2bb
SHA512

7bf13e7829d0a7ea9512aa9cf35d9ea0b83b89081de14f2847f1e7776feaafe2931fb9b370a87882ac7434ea848c375cb949177b777b1d8a5027772cdfa4f58f
SSDEEP

24576:oIMRSyu62aAQnLc0HCrtTUVf+MfzTo2SPAYQDzLPUazVBPlvrrxT1F1H/UQZMH5f:G2aHbHCrkViQZk+zTE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49cb0a48f8ce7be29e3c8b82c39d6d80N.exe

Files

49cb0a48f8ce7be29e3c8b82c39d6d80N.exe
.dll windows:4 windows x86 arch:x86

c4a8b96ed2a5ab5c3957f59490078e70

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_close
_fdopen
_read
_write
__dllonexit
__setusermatherr
_amsg_exit
_close
_errno
_initterm
_iob
_lock
_lseeki64
_onexit
_open
_stricmp
_strnicmp
_unlock
_wfopen
_wgetenv
_wopen
abort
atof
calloc
fclose
fopen
fprintf
free
fwrite
malloc
memcpy
memmove
memset
realloc
sscanf
strerror
strlen
strncmp
strncpy
vfprintf
wcslen
wcsncmp

kernel32

DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesW
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte

shlwapi

PathCombineW
PathIsRelativeW
PathIsUNCW

Exports

Exports

mpg123_add_string
mpg123_add_substring
mpg123_chomp_string
mpg123_clip
mpg123_close
mpg123_copy_string
mpg123_current_decoder
mpg123_decode
mpg123_decode_frame
mpg123_decode_frame_32
mpg123_decode_frame_64
mpg123_decoder
mpg123_decoders
mpg123_delete
mpg123_delete_pars
mpg123_enc_from_id3
mpg123_encodings
mpg123_encsize
mpg123_eq
mpg123_errcode
mpg123_exit
mpg123_feature
mpg123_feed
mpg123_feedseek
mpg123_feedseek_32
mpg123_feedseek_64
mpg123_fmt
mpg123_fmt_all
mpg123_fmt_none
mpg123_fmt_support
mpg123_format
mpg123_format_all
mpg123_format_none
mpg123_format_support
mpg123_framebyframe_decode
mpg123_framebyframe_decode_32
mpg123_framebyframe_decode_64
mpg123_framebyframe_next
mpg123_framedata
mpg123_framelength
mpg123_framelength_32
mpg123_framelength_64
mpg123_framepos
mpg123_framepos_32
mpg123_framepos_64
mpg123_free_string
mpg123_geteq
mpg123_getformat
mpg123_getformat2
mpg123_getpar
mpg123_getparam
mpg123_getstate
mpg123_getvolume
mpg123_grow_string
mpg123_icy
mpg123_icy2utf8
mpg123_id3
mpg123_index
mpg123_index_32
mpg123_index_64
mpg123_info
mpg123_init
mpg123_init_string
mpg123_length
mpg123_length_32
mpg123_length_64
mpg123_meta_check
mpg123_meta_free
mpg123_new
mpg123_new_pars
mpg123_noise
mpg123_open
mpg123_open_32
mpg123_open_64
mpg123_open_fd
mpg123_open_fd_32
mpg123_open_fd_64
mpg123_open_feed
mpg123_open_handle
mpg123_open_handle_32
mpg123_open_handle_64
mpg123_outblock
mpg123_par
mpg123_param
mpg123_parnew
mpg123_plain_strerror
mpg123_position
mpg123_position_32
mpg123_position_64
mpg123_rates
mpg123_read
mpg123_replace_buffer
mpg123_replace_reader
mpg123_replace_reader_32
mpg123_replace_reader_64
mpg123_replace_reader_handle
mpg123_replace_reader_handle_32
mpg123_replace_reader_handle_64
mpg123_reset_eq
mpg123_resize_string
mpg123_safe_buffer
mpg123_scan
mpg123_seek
mpg123_seek_32
mpg123_seek_64
mpg123_seek_frame
mpg123_seek_frame_32
mpg123_seek_frame_64
mpg123_set_filesize
mpg123_set_filesize_32
mpg123_set_filesize_64
mpg123_set_index
mpg123_set_index_32
mpg123_set_index_64
mpg123_set_string
mpg123_set_substring
mpg123_spf
mpg123_store_utf8
mpg123_strerror
mpg123_strlen
mpg123_supported_decoders
mpg123_tell
mpg123_tell_32
mpg123_tell_64
mpg123_tell_stream
mpg123_tell_stream_32
mpg123_tell_stream_64
mpg123_tellframe
mpg123_tellframe_32
mpg123_tellframe_64
mpg123_timeframe
mpg123_timeframe_32
mpg123_timeframe_64
mpg123_tpf
mpg123_volume
mpg123_volume_change

Sections

.text
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 65KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 324KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 390KB - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4a8b96ed2a5ab5c3957f59490078e70

Headers

File Characteristics

Imports

msvcrt

kernel32

shlwapi

Exports

Exports

Sections

.text Size: 294KB - Virtual size: 293KB

.data Size: 2KB - Virtual size: 1KB

.rodata Size: 512B - Virtual size: 432B

.rdata Size: 33KB - Virtual size: 32KB

.bss Size: - Virtual size: 65KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 7KB - Virtual size: 7KB

/4 Size: 2KB - Virtual size: 2KB

/19 Size: 324KB - Virtual size: 324KB

/31 Size: 28KB - Virtual size: 28KB

/45 Size: 76KB - Virtual size: 76KB

/57 Size: 21KB - Virtual size: 21KB

/70 Size: 2KB - Virtual size: 2KB

/81 Size: 390KB - Virtual size: 390KB

/92 Size: 36KB - Virtual size: 35KB

.text
Size: 294KB - Virtual size: 293KB

.data
Size: 2KB - Virtual size: 1KB

.rodata
Size: 512B - Virtual size: 432B

.rdata
Size: 33KB - Virtual size: 32KB

.bss
Size: - Virtual size: 65KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 7KB - Virtual size: 7KB

/4
Size: 2KB - Virtual size: 2KB

/19
Size: 324KB - Virtual size: 324KB

/31
Size: 28KB - Virtual size: 28KB

/45
Size: 76KB - Virtual size: 76KB

/57
Size: 21KB - Virtual size: 21KB

/70
Size: 2KB - Virtual size: 2KB

/81
Size: 390KB - Virtual size: 390KB

/92
Size: 36KB - Virtual size: 35KB