0ec6aa9d8c56c8581a1cebcf8b53b4f0 | Triage

Sharing

General

Target

0ec6aa9d8c56c8581a1cebcf8b53b4f0
Size

21KB
MD5

0ec6aa9d8c56c8581a1cebcf8b53b4f0
SHA1

7fc0e62f21b903c7152d2303691b7c2ee2067aa2
SHA256

774f06036bb605c20256e972937ebb2cd2ee2a57e377070e866cde08bd9dc91c
SHA512

9c948ab9f25ab4b531d114bd4ad0cf9c72c1af6bb915b3140f60f2f86e06cc6fce6151789746044dd16b3e8f328d85c896ea367a9a13f155df6cb1632a732859
SSDEEP

384:qTikV0jk/Zw91Rtf+BTevVX9oLK0+dKGGI9TQGAgjG9FK:qTiIcgZaPh+BeVeK0+Qk9cGAogo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ec6aa9d8c56c8581a1cebcf8b53b4f0

Files

0ec6aa9d8c56c8581a1cebcf8b53b4f0
.exe windows:1 windows x86 arch:x86

9e029c18a437c3456e7b3238d643070d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

Extract
CreateAsyncBindCtx
DllCanUnloadNow
IsAsyncMoniker
ZonesReInit
IsValidURL
URLDownloadW

wsock32

accept
bind
htons
sethostname
WSAStartup
htonl
SetServiceA
gethostbyaddr
listen

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE