444b324b11911b7360b4b166a956ecec

Sharing

Copy URL Twitter E-mail

General

Target

444b324b11911b7360b4b166a956ecec
Size

152KB
MD5

444b324b11911b7360b4b166a956ecec
SHA1

e8401a3a3f7a6344d9666e6d89dc2585896c0097
SHA256

430adcf4ab04b842cbf5be57048b1eb4a2ddcd212b407102139bdcb463983f24
SHA512

c39dbce2c1cee9d0aeb98ca8b45b72da231ebc2268dbb1fe9d11d8bc6ed6215fe5203a2066ba64f428e0e13c80b0c67730e8b5673cd421466d3dcb493a5f0591
SSDEEP

3072:1A7QSuSHr+KLEsKNS3oAUubFVPo3pmIjPWfQJtHHfaGQ8ctlR7:1A7QSucNT4SYAUubFVg3pZ+0lXZct

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
444b324b11911b7360b4b166a956ecec

Files

444b324b11911b7360b4b166a956ecec
.exe windows:4 windows x86 arch:x86

86baf45cdb962c0e334339385903195a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

cygwin1

__errno
__main
_impure_ptr
atoi
calloc
chdir
cygwin_internal
dlclose
dlerror
dll_crt0__FP11per_process
dlopen
dlsym
exit
free
getenv
malloc
memset
pthread_atfork
pthread_getspecific
pthread_mutex_destroy
realloc
signal
strcpy
strlen

cygperl5_8

PL_do_undump
PL_op_mutex
PL_sigfpe_saved
Perl_Gthr_key_ptr
Perl_Imodglobal_ptr
Perl_Isv_no_ptr
Perl_Isv_undef_ptr
Perl_Isv_yes_ptr
Perl_Itainting_ptr
Perl_Tmarkstack_ptr_ptr
Perl_Top_ptr
Perl_Tstack_base_ptr
Perl_Tstack_max_ptr
Perl_Tstack_sp_ptr
Perl_atfork_lock
Perl_atfork_unlock
Perl_block_gimme
Perl_croak
Perl_croak_nocontext
Perl_form
Perl_get_sv
Perl_hv_fetch
Perl_mg_set
Perl_newRV
Perl_newSV
Perl_newSViv
Perl_newSVnv
Perl_newSVpv
Perl_newSVpvn
Perl_newXS
Perl_safesysfree
Perl_safesysmalloc
Perl_stack_grow
Perl_sv_2bool
Perl_sv_2iv
Perl_sv_2mortal
Perl_sv_2pv_flags
Perl_sv_2pv_nolen
Perl_sv_2uv
Perl_sv_grow
Perl_sv_mortalcopy
Perl_sv_newmortal
Perl_sv_setiv
Perl_sv_setpv
Perl_sv_setpvn
Perl_sv_setuv
Perl_sv_taint
Perl_sv_upgrade
Perl_vmess
perl_alloc
perl_construct
perl_destruct
perl_free
perl_parse
perl_run

advapi32

GetUserNameA
LookupAccountNameA

kernel32

CloseHandle
CopyFileA
CreateProcessA
FindClose
FindFirstFileA
FormatMessageA
FreeLibrary
GetComputerNameA
GetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
GetLastError
GetModuleHandleA
GetProcAddress
GetShortPathNameA
GetTickCount
GetVersionExA
GetVolumeInformationA
LoadLibraryA
SetLastError
Sleep
WideCharToMultiByte

Exports

Exports

XS_DynaLoader_dl_error
XS_DynaLoader_dl_find_symbol
XS_DynaLoader_dl_install_xsub
XS_DynaLoader_dl_load_file
XS_DynaLoader_dl_undef_symbols
XS_DynaLoader_dl_unload_file
boot_DynaLoader
boot_Win32CORE
w32_CopyFile
w32_DomainName
w32_FormatMessage
w32_FsType
w32_GetCwd
w32_GetFullPathName
w32_GetLastError
w32_GetLongPathName
w32_GetNextAvailDrive
w32_GetOSVersion
w32_GetShortPathName
w32_GetTickCount
w32_IsWin95
w32_IsWinNT
w32_LoginName
w32_NodeName
w32_SetChildShowWindow
w32_SetCwd
w32_SetLastError
w32_Sleep
w32_Spawn

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 240B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 863B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

86baf45cdb962c0e334339385903195a

Headers

File Characteristics

Imports

cygwin1

cygperl5_8

advapi32

kernel32

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 25KB

.data Size: 512B - Virtual size: 16B

.rdata Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 240B

.edata Size: 1024B - Virtual size: 863B

.idata Size: 3KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 696B

.data Size: 63KB - Virtual size: 128KB

.text Size: 46KB - Virtual size: 46KB

.bss Size: - Virtual size: 27KB

.data Size: 7KB - Virtual size: 7KB

.text
Size: 25KB - Virtual size: 25KB

.data
Size: 512B - Virtual size: 16B

.rdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 240B

.edata
Size: 1024B - Virtual size: 863B

.idata
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 696B

.data
Size: 63KB - Virtual size: 128KB

.text
Size: 46KB - Virtual size: 46KB

.bss
Size: - Virtual size: 27KB

.data
Size: 7KB - Virtual size: 7KB