d51a154c43964e9060e022535d454572 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d51a154c43964e9060e022535d454572
Size

18KB
MD5

d51a154c43964e9060e022535d454572
SHA1

67180c3a2504ec7368aa13a77077408612da2930
SHA256

526db9e57fd9d03098a4ca647fd59e6961d4ccc10042d2d8bef0f4ec2b9e6426
SHA512

4abb600cec7a2d764598aeb50263d1a4dc02ddcf29c12ad13f8ba4d88bbf98ad5bef0ca96c1a95575657cf5a59bd3295442a812256c9007186b1ace04a1baa65
SSDEEP

384:lG7d7wyIbW+mNwwjahoHrHsR3ih29ki5C567kQD4owDRhBeaV:4Ey+klYyibk9c4oHa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/wu262.exe

Files

d51a154c43964e9060e022535d454572
.zip
wu262.c
wu262.exe
.exe windows:4 windows x86 arch:x86

8b0776dcc3e80688602a4b8c7693bd82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

cygwin1

__main
__progname
abort
atoi
bzero
calloc
close
connect
cygwin_internal
dll_crt0__FP11per_process
exit
fflush
fprintf
fputc
free
getenv
gethostbyname
htons
malloc
memset
pthread_mutex_lock
pthread_mutex_unlock
read
realloc
recv
select
send
sleep
snprintf
socket
strcmp
strlen
strncmp
strncpy
strstr
strtoul
vfprintf
write

kernel32

AddAtomA
FindAtomA
GetAtomNameA
GetModuleHandleA

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 384B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE