17df395b9ebd8674913cf714316c218b7e0869cc9ad96f4b5c69bcdae249203e | Triage

Sharing

General

Target

17df395b9ebd8674913cf714316c218b7e0869cc9ad96f4b5c69bcdae249203e
Size

20KB
MD5

73bd1bd51bddf6100e522cad8913928f
SHA1

95e41589ae2df7352105e173c6cf0abd4e3dcd02
SHA256

17df395b9ebd8674913cf714316c218b7e0869cc9ad96f4b5c69bcdae249203e
SHA512

a19aaec053fdbaa0c92d1df7f31df250733cd23d2adf4bca74156b5f85edd4a4323165a3d9c71a8374522ad7dd7eeeef2c09f8c23392f2e5bb869e6e34081334
SSDEEP

192:5jh9X+JOjfekOE2vyzygRSsKrSkWSk02Uoyn:xn+ojIH6yO1CKoz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17df395b9ebd8674913cf714316c218b7e0869cc9ad96f4b5c69bcdae249203e

Files

17df395b9ebd8674913cf714316c218b7e0869cc9ad96f4b5c69bcdae249203e
.exe windows x86

291e6b3b8fac4f74d587594ce737b627

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateThread
VirtualAlloc
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
Sleep
GetModuleHandleA
GetStartupInfoA

ws2_32

connect
send
recv
getservbyport
ntohs
gethostbyaddr
getservbyname
inet_addr
gethostbyname
WSAGetLastError
htonl
inet_ntoa
socket
WSASetLastError
WSAStartup
htons

msvcrt

calloc
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??2@YAPAXI@Z
__CxxFrameHandler
exit
free
strncpy
??3@YAXPAX@Z
strtoul
strchr
sprintf

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ