Malware_Investigations_Assignment_2[.]exe

Resubmissions

11/12/2023, 15:46

231211-s7m7hscdc6 7

11/12/2023, 08:19

231211-j758nahfgr 8

Sharing

Copy URL Twitter E-mail

General

Target

Malware_Investigations_Assignment_2.exe
Size

516KB
MD5

ebd9eb2a448fbfa4b6ed13e8a1dc0aa9
SHA1

a7bbe3e72bf79d61110ea0bbc78a1471f3618619
SHA256

f440937ac6414f3c24e1ce421513cd4a62ea7c8fb43e95b652ed525babcd74d3
SHA512

04e84d738e5eee98fb24df07268a9f0042cf84618be774002b64dc50b547e4932ed17f98f23862d10ee485e37550d503bb5e5a8f1dbf5af6b85f9ad82cc87f76
SSDEEP

6144:mv8+MX6FwtvGMEy7Br2pVZTMDcCpfC43YNDuopLyr:a8uGLj1rHDcC8NDuop4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Malware_Investigations_Assignment_2.exe

Files

Malware_Investigations_Assignment_2.exe
.exe windows:6 windows x86 arch:x86

8fa68b5e546490c2c18f34946dc09838

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteExA
ShellExecuteA

ws2_32

WSACleanup
WSAStartup
accept
WSAGetLastError
socket
send
recv
listen
htons
connect
closesocket
bind
gethostbyname

advapi32

RegSetValueExA
RegOpenKeyExA
GetUserNameA
CheckTokenMembership
ConvertStringSidToSidA

urlmon

URLDownloadToFileA

wininet

InternetOpenA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA

kernel32

ReadConsoleW
ReadFile
CreateFileW
GetConsoleMode
GetConsoleOutputCP
GetFileSizeEx
SetConsoleCtrlHandler
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
SetFilePointerEx
HeapSize
SetEndOfFile
WriteConsoleW
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
DeleteFileA
CloseHandle
WaitForSingleObject
Sleep
GetModuleFileNameA
LocalFree
CopyFileA
GetComputerNameA
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
FindNextFileW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapReAlloc
HeapFree
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
GetTempPathW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetCurrentThread
OutputDebugStringW
FindClose
FindFirstFileExW
CreateProcessA

Sections

.text
Size: 444KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

8fa68b5e546490c2c18f34946dc09838

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ws2_32

advapi32

urlmon

wininet

kernel32

Sections

.text Size: 444KB - Virtual size: 443KB

.rdata Size: 50KB - Virtual size: 50KB

.data Size: 4KB - Virtual size: 9KB

.idata Size: 4KB - Virtual size: 4KB

.00cfg Size: 512B - Virtual size: 270B

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 444KB - Virtual size: 443KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 4KB - Virtual size: 9KB

.idata
Size: 4KB - Virtual size: 4KB

.00cfg
Size: 512B - Virtual size: 270B

.reloc
Size: 11KB - Virtual size: 11KB