ipconfig[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ipconfig.exe
Size

34KB
MD5

3d33188ecd39ecfeea2e08996891c76e
SHA1

80d6d97b90bccdd9de6301e074a8ef2f5b8f600c
SHA256

c5dbbddd1193c7adca1e30cd17b8c7af6a76c406dd84dc164bb959c135f1aa70
SHA512

5404cfb23f038441617582f6840368c0911764d3c2932e8d1e565f9ba04a9d64918895395a63d4d2d78164863b10228a231fd56957ef7bf45ae3ed7894e6d79e
SSDEEP

768:u23HOsYksucX/iBYuoQeR38BgCnkkYIb9V:ZHO7eYuqR38BFkfc9V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ipconfig.exe

Files

ipconfig.exe
.exe windows x64

15167a60983bfc39b2da4f53b9b1f28c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

wcschr
_wcsicmp
_get_osfhandle
fflush
_setmode
_write
_fileno
fgetpos
fwprintf
__C_specific_handler
__setusermatherr
_cexit
_exit
__set_app_type
__wgetmainargs
__iob_func
_amsg_exit
_fmode
_commode
?terminate@@YAXXZ
toupper
_XcptFilter
exit
memcpy
setlocale
_initterm
_vsnwprintf
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleHandleW

iphlpapi

ConvertGuidToStringW
ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToGuid
GetNetworkParams
GetAdaptersAddresses
GetCurrentThreadCompartmentId
ConvertInterfaceIndexToLuid
SetCurrentThreadCompartmentId
ConvertLengthToIpv4Mask

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ntdll

RtlIpv6AddressToStringW
RtlStringFromGUID
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFreeUnicodeString

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadUILanguage

ws2_32

InetNtopW

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
GetFileType

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

dnsapi

DnsFlushResolverCache
DnsFreeConfigStructure
DnsResolverOp
DnsQuery_W
DnsFree
DnsQueryConfigAllocEx
DnsGetCacheDataTable

api-ms-win-core-heap-l1-1-0

HeapSetInformation
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-console-l1-1-0

GetConsoleMode

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

nsi

NsiFreeTable
NsiAllocateAndGetTable
NsiGetAllParameters
NsiSetAllParameters

dhcpcsvc

DhcpHandlePnPEvent
DhcpReleaseParameters
DhcpAcquireParameters
DhcpEnumClasses

dhcpcsvc6

Dhcpv6SetUserClass
Dhcpv6IsEnabled
Dhcpv6AcquireParameters
Dhcpv6ReleaseParameters
Dhcpv6GetUserClasses

api-ms-win-security-base-l1-1-0

FreeSid
CheckTokenMembership
AllocateAndInitializeSid

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15167a60983bfc39b2da4f53b9b1f28c

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

iphlpapi

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

ntdll

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

ws2_32

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

dnsapi

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

nsi

dhcpcsvc

dhcpcsvc6

api-ms-win-security-base-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 720B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 176B

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 720B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 176B