2f3bbdd8ba32e90f9fceeadf50d2bcf1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f3bbdd8ba32e90f9fceeadf50d2bcf1
Size

256KB
MD5

2f3bbdd8ba32e90f9fceeadf50d2bcf1
SHA1

4dcdb0505357aec165c46ebf012c0f10885e0d01
SHA256

c6e1794ea72eeeff4117eb942e19ed0ee88ec318e37804ee4df4595e55750554
SHA512

c4c92a0da90131862466820d5dd8d5553a030565eefbc4503b0dd8a0d5bcf3e2e5435ca8d373dc94667430a031b5f7e3c988ea37d091722fd3945988816eed02
SSDEEP

6144:vXUVzAv50HNExKLxIA64nCxm1J0sBrNvNes7/HN+9:PMzk0HNNLxsGBrNle2/0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f3bbdd8ba32e90f9fceeadf50d2bcf1

Files

2f3bbdd8ba32e90f9fceeadf50d2bcf1
.exe windows:4 windows x86 arch:x86

fac9709d557dec3b1452acf0d2622f74

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFilePointer
WriteFile
GlobalFree
GlobalAlloc
LocalFree
LocalAlloc
MoveFileExA

ws2_32

WSAStartup
socket
WSACleanup
send
WSACloseEvent
WSAConnect
WSACreateEvent
WSAAddressToStringA

msvcrt

__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
wcslen
fclose
fwrite
fseek
fopen
free
malloc
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
_onexit

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ