tftpd32[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tftpd32.exe
Size

211KB
MD5

814d1cfd88ca49037cd15680178d1afd
SHA1

81821a9fc0162f2607811e44f9a62e74885d860b
SHA256

de3636c98e3d7f2d0ecfbe3ac50f29ece5b03262a1dff52bf7e8903972f97b3c
SHA512

e0cd88f50219a01331e5d6dcd0435693ee6df40b781d5ad3a45da442779271546fcbf9cd987fa58977fc36ab31f924a3a8c3e52bdd162ab6c567d73bda391eac
SSDEEP

3072:WXqPaNTjcDhgJ20fEr9Sc5zgdZUO89q6/Kuvak2bkgorG+llSFw3/n:QTjpU0fEr99zU899/KauHOd/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tftpd32.exe

Files

tftpd32.exe
.exe windows x86

83cab15169100a9c1ad2f188b3dcb6bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHBrowseForFolderA
DragFinish
DragAcceptFiles
DragQueryFileA
ShellExecuteA
SHGetPathFromIDListA
Shell_NotifyIconA

ws2_32

listen
accept
select
ntohs
getsockname
WSACloseEvent
WSAEventSelect
WSACreateEvent
gethostbyname
WSAIoctl
gethostname
inet_ntoa
ntohl
htonl
setsockopt
bind
getservbyname
WSAStartup
WSACleanup
connect
recvfrom
getaddrinfo
WSAGetLastError
sendto
recv
socket
freeaddrinfo
getpeername
closesocket
WSAAsyncSelect
getnameinfo
inet_addr
htons
send
WSASetLastError

comctl32

InitCommonControlsEx

iphlpapi

DeleteIpNetEntry
GetIpNetTable
GetAdaptersAddresses
SendARP

kernel32

SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
DeleteCriticalSection
LCMapStringW
IsProcessorFeaturePresent
RtlUnwind
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
QueryPerformanceCounter
GetCurrentProcessId
GetConsoleCP
MultiByteToWideChar
GetConsoleMode
lstrlenA
lstrcatA
lstrcmpiA
GetModuleFileNameA
lstrcpyA
lstrcpynA
lstrcmpA
GetEnvironmentVariableA
GetCurrentProcess
Sleep
GetLastError
SetLastError
SetProcessWorkingSetSize
CreateMutexA
ReleaseMutex
CloseHandle
GetFullPathNameA
GetVersion
GetLocalTime
CreateProcessA
CreateFileA
GetFileSize
WaitForSingleObject
WriteFile
GetFileAttributesA
CreateSemaphoreA
ReadFile
ReleaseSemaphore
SetCurrentDirectoryA
GetCurrentDirectoryA
DeleteFileA
SetFilePointer
FlushFileBuffers
GetTickCount
GetCurrentThreadId
ResetEvent
GetSystemTime
SetEvent
GetCurrentThread
CreateEventA
SetThreadPriority
WaitForMultipleObjects
CreateThread
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringA
LocalFree
FormatMessageA
GetSystemTimeAsFileTime
FindClose
FindNextFileA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetACP
GetCPInfo
LoadLibraryW
ExitProcess
LeaveCriticalSection
EnterCriticalSection
HeapCreate
GetProcAddress
InterlockedDecrement
GetModuleHandleW
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetTimeZoneInformation
WideCharToMultiByte
DecodePointer
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStringTypeW
FindFirstFileExA
GetDriveTypeA
HeapReAlloc
HeapAlloc
ResumeThread
ExitThread
GetModuleFileNameW
GetStdHandle
GetFileType
WriteConsoleW
HeapFree
SetStdHandle
GetDriveTypeW
SetEndOfFile
GetProcessHeap
HeapSize
CompareStringW
SetEnvironmentVariableA
CreateFileW

user32

DialogBoxParamA
CreateWindowExA
RegisterClassA
GetClassInfoA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetFocus
SetWindowsHookExA
UnhookWindowsHookEx
SystemParametersInfoA
MessageBeep
wvsprintfA
MapDialogRect
InvalidateRect
RedrawWindow
MoveWindow
SetTimer
SendDlgItemMessageA
KillTimer
SetForegroundWindow
LoadIconA
ChildWindowFromPoint
GetWindowTextA
SetWindowLongA
MessageBoxA
UnregisterClassA
SetClassLongA
SetDlgItemTextA
SetWindowTextA
DefWindowProcA
GetSysColor
IsWindow
GetSystemMetrics
EnableWindow
CallWindowProcA
FindWindowA
DestroyIcon
CheckMenuItem
GetWindow
GetDC
DestroyWindow
GetSystemMenu
GetWindowRect
CreateDialogParamA
GetTopWindow
GetClientRect
SetWindowPos
ShowWindow
AppendMenuA
IsWindowVisible
GetDialogBaseUnits
PostMessageA
GetDlgItemInt
SetDlgItemInt
GetDlgItemTextA
TrackPopupMenu
GetSubMenu
GetParent
LoadMenuA
wsprintfA
GetWindowLongA
GetDlgItem
GetCursorPos
DestroyMenu
SendMessageA
EndDialog
ReleaseDC

gdi32

SetTextColor
ExtTextOutA
GetTextMetricsA
LPtoDP
GetTextExtentPoint32A
SetBkColor

comdlg32

GetOpenFileNameA

advapi32

RegSetValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83cab15169100a9c1ad2f188b3dcb6bd

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ws2_32

comctl32

iphlpapi

kernel32

user32

gdi32

comdlg32

advapi32

Sections

.text Size: 138KB - Virtual size: 138KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 28KB - Virtual size: 122KB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 138KB - Virtual size: 138KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 28KB - Virtual size: 122KB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 11KB - Virtual size: 11KB