0c1a8ca6df03db2a067510a832c989ca | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c1a8ca6df03db2a067510a832c989ca
Size

16KB
MD5

0c1a8ca6df03db2a067510a832c989ca
SHA1

f8b7bff0fe1e829d28739451ad76930ba3520964
SHA256

e70b3d26ff3d98ef0f7ce8c3c5b3d200d9bb3cf46d8f4f0730dac9acc5fa2aeb
SHA512

e7cfdcd70a17de6029d0776eeb30e48fdebae9dcfcf51eef9b9805180f564e2f205245058562ca4a8428b13a113a8ee257aa743c7bcdd3af71a49ada685890a0
SSDEEP

96:nrBtYy4Yc6ULzJZ1Q/XvdzcJCoG3kqkCZ7eCPPh2JARjO:noy4J6+zJZavZeCofNCZ64Qs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c1a8ca6df03db2a067510a832c989ca

Files

0c1a8ca6df03db2a067510a832c989ca
.exe windows:4 windows x86 arch:x86

7d3e33ed22e5a1299a57849e9a48c865

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
ExitProcess
TerminateThread
GetProcessHeap
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
HeapAlloc
GetCurrentProcessId
GetTickCount
CopyFileA
Sleep

user32

MessageBoxA

advapi32

RegCreateKeyA
RegCloseKey
RegSetValueExA
RegDeleteKeyA

shell32

ShellExecuteA

ws2_32

inet_addr
gethostbyname
sendto
setsockopt
WSASocketA
closesocket
recv
send
connect
htons
socket
WSAStartup

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE