shadowbot[.]jpg

Sharing

Copy URL Twitter E-mail

General

Target

shadowbot.jpg
Size

200KB
MD5

b02137bd23d4b23ddbd774feeb3229ee
SHA1

7c443553aa2e19a56f93cf15b10d80d5c2d9fcc4
SHA256

f5327e29e6559126805f259f17a1c2acd0e32545e7e1046ed93547464b5dcc33
SHA512

b3cfc242dc79b1b9eb257e34a231e81da336670376c22f8d6fd341e9aa0309014692444d27b25dfad57d34348e91562a9d235230cfec4cfcda065e17864de0ce
SSDEEP

1536:kladjpL6ZGgce8Eh1ZmVDjwP0kN2Zxr4Q3ND5hAJettHSf:2adFLWGLe8eoVDjwskN2MQhPA4tHk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shadowbot.jpg

Files

shadowbot.jpg
.exe windows x86

948e4a9ff89cca7dcdd838b187899c0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GlobalAlloc
UnmapViewOfFile
lstrlenA
MapViewOfFile
CreateFileMappingA
SetFilePointer
WriteFile
CloseHandle
GetFileSize
CreateFileA
Sleep
ReadProcessMemory
OpenProcess
Module32Next
DeleteFileA
TerminateProcess
SetFileAttributesA
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetModuleFileNameA
GetModuleHandleA
ReadFile
lstrcatA
GetTempPathA
lstrcpyA
CreateThread
GetTickCount
CreateProcessA
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
GetFullPathNameA
SetCurrentDirectoryA
FindFirstFileA
GetDriveTypeA
ExitThread
GetLocaleInfoA
GetLastError
CreateMutexA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
SetEnvironmentVariableA
SetConsoleCtrlHandler
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetTimeZoneInformation
GetSystemTime
GetLocalTime
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
SetHandleCount
GetFileType
GetStartupInfoA
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapFree
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate

user32

CharLowerA
wsprintfA

ws2_32

WSACleanup
inet_ntoa
WSAStartup
connect
htons
bind
listen
accept
recv
closesocket
send
inet_addr
socket
gethostbyname

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

948e4a9ff89cca7dcdd838b187899c0f

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

wininet

Sections

.text Size: 160KB - Virtual size: 156KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 16KB - Virtual size: 22KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 160KB - Virtual size: 156KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 22KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 4KB