22001ec3b40a2f92e2fdbb59675ce7f1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

22001ec3b40a2f92e2fdbb59675ce7f1
Size

8KB
MD5

22001ec3b40a2f92e2fdbb59675ce7f1
SHA1

2e8fa83f977fe0c87e2a8ff4f58c0e267e69dc67
SHA256

b6be31dbba83c52bd9910b4f517dc62abeb6ab766741c45c1963a4c370906266
SHA512

88077545e72d557d452071c09da0cc3c211ca12792ff63a69cca05d3148cd1e22691064e19f2c5628546a5f274123ed6f6e43b18f93938c6a7a1c6cff80d23ce
SSDEEP

192:nJvck8YarPQnLtTCPZy5fCN+yZv1MfpRGvUpp8u:nJvcXPSTCPM5CNafGvUppH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22001ec3b40a2f92e2fdbb59675ce7f1

Files

22001ec3b40a2f92e2fdbb59675ce7f1
.exe windows:5 windows x86 arch:x86

e2f14eac1917776fe474971288981cf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
inet_addr
ioctlsocket
WSAGetLastError
htons
recv
socket
select
closesocket
gethostbyname
send

shlwapi

SHSetValueW

kernel32

GetTickCount
Sleep
GetModuleHandleW
CreateThread
LocalFree
CloseHandle
ReleaseMutex
CreateMutexA
lstrcatW
LocalAlloc
GetLastError
lstrlenW
GetModuleFileNameW
GetFileAttributesW
ExitProcess
lstrlenA
CreateProcessW
WaitForSingleObject
CopyFileW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE