0906ed8d94a2268c8911469587308d3c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0906ed8d94a2268c8911469587308d3c
Size

32KB
MD5

0906ed8d94a2268c8911469587308d3c
SHA1

932a02a99b45ee70312cf460eb70b164c10f091b
SHA256

6128ffb25ca295873bba072c853da0b174085d1d8a5f948d948d4100fc9cc839
SHA512

c1143dbbe7acd0502d8c44e905042e15c0f75227e212c2f014ac12ec495f8a641dd589bab040c74fa331b5ffccaea745e826ba231c34c2fb6f939cdbb44c65b0
SSDEEP

384:QD/sz/P1ZmuMV0h2wAr/yfX91RHyvgPXkjn1P/BJFY:WsTLdMVQ2wS/MHyWU9zFY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0906ed8d94a2268c8911469587308d3c

Files

0906ed8d94a2268c8911469587308d3c
.exe windows:4 windows x86 arch:x86

2ba73d66c4f64239d0f6c42f16ba4a6b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeviceIoControl
WaitForSingleObject
LoadLibraryA
lstrlenA
GetProfileStringW
lstrcmpA
GetModuleHandleA
GetStartupInfoA

ole32

CoCreateInstance
CLSIDFromString
CoTaskMemAlloc
CoInitialize
CoTaskMemFree

ws2_32

getservbyname
setsockopt
socket
getservbyport
ioctlsocket
listen
ntohl
inet_addr
select
recv
send
inet_ntoa
getprotobynumber

msvcrt

atoi
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
gmtime
exit
strlen
time
memmove
strchr
_except_handler3

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ