f395aeea503012835fb75910cf3735135513b37e29935a0c43b581dfff3912e7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f395aeea503012835fb75910cf3735135513b37e29935a0c43b581dfff3912e7
Size

5KB
MD5

4413c9787faf4512848fae8056145bdf
SHA1

e8d79ba456439e2f9de8b2b11398209432756353
SHA256

f395aeea503012835fb75910cf3735135513b37e29935a0c43b581dfff3912e7
SHA512

cefddd8aa13524b7887b2876ab4a4b174f0c85e2081aeee5d27d83a71bb4c1f19bf08e1849fbe20f6253abdb7ecfa1afbf6599d3bb5c623b24eaa07e0e204dd1
SSDEEP

96:Z1QdZqS5/wGSQlQxCuYEElcWpWttVRoXffwomCVL:ExOGvlaQcWpe3Rqfw5K

Score

N/A

Malware Config

Signatures

Files

f395aeea503012835fb75910cf3735135513b37e29935a0c43b581dfff3912e7
.exe windows x86

3ceb1f41172ed28911441af88a526b96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CopyFileA
CreateFileA
CreateThread
ExitThread
FindFirstFileA
FindNextFileA
GetFileSize
GetModuleFileNameA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
ReadFile
SetFilePointer
Sleep
VirtualProtect
WriteFile
lstrlenA

wsock32

socket
WSAStartup
gethostbyname
htons
connect
recv
send
closesocket

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

Sections

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 786B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ