1bbe63929f7ccacba94a33b9d2f58983

General

Target

1bbe63929f7ccacba94a33b9d2f58983
Size

16KB
MD5

1bbe63929f7ccacba94a33b9d2f58983
SHA1

7cd70204dd865cdbbc1b5e2f9a7c7b06dafc7317
SHA256

56119a8750713ce868cdd52e0225a80eb5fe7ae186f6fc92428de9d6aacddceb
SHA512

f1543e8aabda74df8528423d7ee2f5ea292df15ebeddc0a0297cd8c9daf8d2cc4a15b41fa079766e23649278c0467b2964d61c8d92efff6886aa73f2fb96a2ec
SSDEEP

192:8VXI7uRwDztPT29H3KOl3PgeIX7SL05Nwbsi7rx+9lxmc/7A12laDdFg/fh:8ouRs29H6QcSL0497cIchYDdMf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bbe63929f7ccacba94a33b9d2f58983

Files

1bbe63929f7ccacba94a33b9d2f58983
.exe windows:5 windows x86 arch:x86

d6621aa8cfde8326406f8618704b54fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
inet_addr
htons
setsockopt
recv
socket
closesocket
gethostbyname
send
WSAStartup

userenv

GetAllUsersProfileDirectoryA

kernel32

CreateThread
ResumeThread
ExitProcess
GetThreadContext
CreateFileA
SetThreadContext
FreeLibrary
SetUnhandledExceptionFilter
GetCurrentProcess
QueryPerformanceCounter
WaitForSingleObject
VirtualFree
WriteFile
Sleep
CreateProcessA
TerminateProcess
GetEnvironmentVariableA
IsBadStringPtrA
GetLastError
lstrcmpiA
GetProcAddress
VirtualAlloc
CopyFileA
VirtualAllocEx
GetTempFileNameA
LoadLibraryA
GetModuleFileNameA
CreateMutexA
ReleaseMutex
CloseHandle
WriteProcessMemory

user32

wsprintfA

advapi32

CreateWellKnownSid
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
EqualSid
RegSetValueExA
GetTokenInformation
OpenProcessToken

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mfgbowf
Size: - Virtual size: 80KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d6621aa8cfde8326406f8618704b54fb

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

userenv

kernel32

user32

advapi32

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 912B

.reloc Size: 1024B - Virtual size: 29KB

mfgbowf Size: - Virtual size: 80KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 912B

.reloc
Size: 1024B - Virtual size: 29KB

mfgbowf
Size: - Virtual size: 80KB