SecuriteInfo[.]com[.]W32[.]Heuristic-170[.]Eldorado[.]14460[.]6995[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

SecuriteInfo.com.W32.Heuristic-170.Eldorado.14460.6995.exe
Size

1.7MB
MD5

b28b86250507a2df2033c215c8bf4e79
SHA1

f1f91269512cf6cdc0ba07f851ecc6dfe3c30d10
SHA256

b6ea08797707c830bab56ed7d6e34ca200a92a5469690a1f1837ee8900e9c641
SHA512

f7208f415dbf8df04ab10d36ec4bb9beb28c4d4fabb194e5106941b14400f47c4ea1e3cca2c776d999ec3403677aef71954209519c07833519d53e8e602bb505
SSDEEP

24576:cK0QtYDm4SXERYV6WcjuEVdgj8umqQ4hrv3nWja3N30:cK0Q5V6JjfEAb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.W32.Heuristic-170.Eldorado.14460.6995.exe

Files

SecuriteInfo.com.W32.Heuristic-170.Eldorado.14460.6995.exe
.exe windows x86

ea15eb7488c93782eb8dc7a577db6aeb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dnsapi

DnsQuery_A
DnsRecordListFree

kernel32

CloseHandle
CreateIoCompletionPort
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetQueuedCompletionStatus
GetSystemDirectoryA
GetSystemTimeAsFileTime
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
PostQueuedCompletionStatus
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

_fdopen
_fstat
_lseek
_read
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_beginthread
_cexit
_close
_errno
_filbuf
_flsbuf
_fstat
_iob
_isctype
_lseek
_onexit
_open
_pctype
_read
_setmode
_strdup
_winmajor
abort
atexit
atof
atoi
calloc
exit
fclose
fflush
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
getwc
iswctype
localeconv
malloc
memchr
memcpy
memmove
putwc
rand
realloc
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strtol
strxfrm
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm

ws2_32

WSACleanup
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSASend
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyname
getservbyname
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
select
send
socket

Sections

.text
Size: 571KB - Virtual size: 570KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/14
Size: 1024B - Virtual size: 608B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/61
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/73
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/87
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/99
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/112
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/123
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/134
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea15eb7488c93782eb8dc7a577db6aeb

Headers

File Characteristics

Imports

dnsapi

kernel32

msvcrt

ws2_32

Sections

.text Size: 571KB - Virtual size: 570KB

.data Size: 70KB - Virtual size: 69KB

/4 Size: 64KB - Virtual size: 64KB

.bss Size: - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

/14 Size: 1024B - Virtual size: 608B

/29 Size: 12KB - Virtual size: 11KB

/45 Size: 10KB - Virtual size: 10KB

/61 Size: 230KB - Virtual size: 230KB

/73 Size: 15KB - Virtual size: 15KB

/87 Size: 34KB - Virtual size: 33KB

/99 Size: 20KB - Virtual size: 20KB

/112 Size: 4KB - Virtual size: 3KB

/123 Size: 142KB - Virtual size: 141KB

/134 Size: 10KB - Virtual size: 10KB

.text
Size: 571KB - Virtual size: 570KB

.data
Size: 70KB - Virtual size: 69KB

/4
Size: 64KB - Virtual size: 64KB

.bss
Size: - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

/14
Size: 1024B - Virtual size: 608B

/29
Size: 12KB - Virtual size: 11KB

/45
Size: 10KB - Virtual size: 10KB

/61
Size: 230KB - Virtual size: 230KB

/73
Size: 15KB - Virtual size: 15KB

/87
Size: 34KB - Virtual size: 33KB

/99
Size: 20KB - Virtual size: 20KB

/112
Size: 4KB - Virtual size: 3KB

/123
Size: 142KB - Virtual size: 141KB

/134
Size: 10KB - Virtual size: 10KB