17f53b6d9b9b0c380a784e5d3acea4b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17f53b6d9b9b0c380a784e5d3acea4b9
Size

15KB
MD5

17f53b6d9b9b0c380a784e5d3acea4b9
SHA1

82bb3e68f6c321528b10f1dcbe6c6dc4a5549630
SHA256

5c2fd6e838de21b5194521089ea29e381c21a0c39e6fee99b617f1884e407378
SHA512

5242478b10b54292346eb64868a3fd09531f841db3fd7cb86a0ad5f3c0df99faa2c213e2941f32a9196b4c4521343094db5a4d47b865b23773977516a1b0b23e
SSDEEP

192:dtUiODTUwXmNajTy6Y0pRqlDH7poJ/OZenrF1QpnkKHH:bUPDTUwXmMyJ8RSDH7poJWSLQpn3n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17f53b6d9b9b0c380a784e5d3acea4b9

Files

17f53b6d9b9b0c380a784e5d3acea4b9
.dll windows:4 windows x86 arch:x86

fedc9a91799e5dd74b31e323577abd52

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
CreateThread

ws2_32

WSAStartup
closesocket
gethostbyname
recv
send
setsockopt
shutdown

ntdll

RtlGetProcessHeaps

Exports

Exports

powstak

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 358B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 658B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ