1d9d3993fcc317f0b39f9cd80fb72e70 | Triage

Sharing

General

Target

1d9d3993fcc317f0b39f9cd80fb72e70
Size

4KB
MD5

1d9d3993fcc317f0b39f9cd80fb72e70
SHA1

d6c72ffbc262b92dec4ed93ab397409357f5691d
SHA256

dc1fc4c091d00990c662c8e40c8faba916ea3ce6839680ec132e47d2b48415a4
SHA512

7b1aa7f45b8da55805478020426c5393ce4df4b4b01b418eb8e2c9b621336cf6e0843764d6880ed402c942b5c808e45cf5444d46c574a45f1b16bebcfeae5062
SSDEEP

96:QZNaYE57NioQk21sDcYX2Qzap/WX2Q+VBdR3Kr+:4NX+NiAFht4VZKr+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d9d3993fcc317f0b39f9cd80fb72e70

Files

1d9d3993fcc317f0b39f9cd80fb72e70
.exe windows:5 windows x86 arch:x86

ff46a535e115517a27af955a8a9b4d36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
send
gethostbyname
socket
htons
connect
closesocket
recv
WSACleanup

shlwapi

StrCmpNIA

kernel32

GlobalFree
CloseHandle
GlobalAlloc
GetCurrentProcess
GetLastError
GetCurrentThread
ExitProcess
SetEvent
HeapFree
Sleep
lstrcmpA
HeapAlloc
GetProcessHeap
CreateEventA
OpenEventA
GetSystemInfo
GetProcAddress
GetModuleHandleA
GetVersionExA
WaitForSingleObject

user32

wsprintfA

advapi32

RegOpenKeyA
RegEnumValueA
RegSetValueExA
RegCloseKey
OpenThreadToken
OpenProcessToken
GetTokenInformation
EqualSid
AllocateAndInitializeSid
CheckTokenMembership
FreeSid

ole32

CoCreateGuid
StringFromGUID2

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ