Static task
static1
Behavioral task
behavioral1
Sample
tftpd32.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tftpd32.exe
Resource
win10v2004-20230221-en
General
-
Target
tftpd32.exe
-
Size
188KB
-
MD5
6bfe5cee0963d0e89496d65f18ed0092
-
SHA1
717fd0302afe1ba613b2e9da0be1ceba91ab9440
-
SHA256
4e17ba6e3b9e2150fd5f70e0c387dd2fd945849e173199099cf18447e7ac8759
-
SHA512
95330e3312a8a9cbd7658b1333d295f8b3abb710c3868727ffd971e66ed2fba3da0b1564a1ee209056a56247e6ed34829ffa6d488256b2310c98d8625d4f18d6
-
SSDEEP
3072:esPVyhu254PJnOyaAGYbrvOj0dealSXOwb2l8HutkSS:efu254PLaA7POjXalUVX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tftpd32.exe
Files
-
tftpd32.exe.exe windows x86
efb8450f76c475fd31a87f78783ead92
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
listen
WSASetLastError
getservbyname
socket
sendto
setsockopt
accept
select
getsockname
WSACloseEvent
WSAEventSelect
WSACreateEvent
connect
WSAGetLastError
recv
bind
WSAStartup
WSACleanup
gethostbyname
ntohs
WSAAsyncSelect
send
gethostname
inet_ntoa
recvfrom
ntohl
inet_addr
htonl
htons
closesocket
comctl32
InitCommonControlsEx
iphlpapi
SendARP
kernel32
SetStdHandle
InitializeCriticalSection
LoadLibraryA
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetOEMCP
GetACP
CreateFileA
SetFilePointer
lstrlenA
WriteFile
Sleep
FlushFileBuffers
GetLocalTime
CloseHandle
GetFileSize
lstrcmpA
GetTickCount
GetLastError
GetCurrentThreadId
lstrcpyA
lstrcpynA
lstrcatA
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCurrentProcess
SetProcessWorkingSetSize
CreateMutexA
ReleaseMutex
GetFullPathNameA
CreateProcessA
WaitForSingleObject
lstrcmpiA
ResetEvent
GetModuleFileNameA
GetCurrentDirectoryA
GetSystemTime
SetEvent
CreateEventA
WaitForMultipleObjects
GetFileAttributesA
CreateSemaphoreA
ReadFile
ReleaseSemaphore
SetCurrentDirectoryA
DeleteFileA
CreateThread
SetThreadPriority
SetLastError
FormatMessageA
LocalFree
OutputDebugStringA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetDateFormatA
FileTimeToSystemTime
FindFirstFileA
FindClose
FindNextFileA
FileTimeToLocalFileTime
GlobalLock
GlobalAlloc
GlobalUnlock
GetSystemTimeAsFileTime
WideCharToMultiByte
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetTimeZoneInformation
GetProcAddress
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetProcessHeap
GetVersionExA
GetCommandLineA
GetDriveTypeA
GetModuleFileNameW
GetStdHandle
GetFileType
WriteConsoleW
HeapReAlloc
HeapAlloc
HeapFree
ResumeThread
ExitThread
LoadLibraryW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
HeapSize
SetEndOfFile
RtlUnwind
GetCPInfo
CompareStringA
CompareStringW
user32
GetClassInfoA
EmptyClipboard
CreateWindowExA
CloseClipboard
GetFocus
wvsprintfA
CallWindowProcA
GetWindowTextA
MapDialogRect
OpenClipboard
MoveWindow
SetCursor
SetTimer
SendDlgItemMessageA
KillTimer
SetForegroundWindow
LoadIconA
SetWindowLongA
MessageBoxA
UnregisterClassA
SetClipboardData
DialogBoxParamA
RegisterClassA
SetWindowsHookExA
UnhookWindowsHookEx
SystemParametersInfoA
InvalidateRect
MessageBeep
SetClassLongA
DefWindowProcA
IsWindow
GetSystemMetrics
EnableWindow
FindWindowA
LoadCursorA
DestroyIcon
CheckMenuItem
GetWindow
GetDC
ReleaseDC
DestroyWindow
GetSystemMenu
GetWindowRect
CreateDialogParamA
GetTopWindow
GetClientRect
SetWindowPos
ShowWindow
AppendMenuA
SetWindowTextA
GetDialogBaseUnits
PostMessageA
GetDlgItemInt
SetDlgItemInt
GetDlgItemTextA
TrackPopupMenu
GetSubMenu
GetParent
LoadMenuA
GetWindowLongA
GetDlgItem
GetCursorPos
DestroyMenu
SendMessageA
wsprintfA
EndDialog
SetDlgItemTextA
IsWindowVisible
gdi32
LPtoDP
GetTextExtentPoint32A
comdlg32
GetOpenFileNameA
advapi32
RegDeleteKeyA
ReportEventA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
DeregisterEventSource
RegisterEventSourceA
shell32
DragFinish
DragAcceptFiles
DragQueryFileA
ShellExecuteA
SHGetPathFromIDListA
SHBrowseForFolderA
Shell_NotifyIconA
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ