51d3fc1f197924010f8313e585a81cd0

General

Target

51d3fc1f197924010f8313e585a81cd0
Size

16KB
MD5

51d3fc1f197924010f8313e585a81cd0
SHA1

489690233bf1791d3d5e98f55945dec4971d24dd
SHA256

45c216c8c3af432e353e9ba9b75542ac1e2f3a66a297f69c9bb39abf59a4b884
SHA512

4f70e5b78feb703e9cc7370bb7fcde2dd0bb40092cc80764c3a92fb71cccce583bf0f447157b721d5bfee924eb0cebe64d1b97a15d0f77c07934c5dcca8a6ed1
SSDEEP

384:2VZET9x9yxDe3F7FJFIpAVgZp8Ryn1cUoXPa:2VZO3uDc2Zz1VoS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51d3fc1f197924010f8313e585a81cd0

Files

51d3fc1f197924010f8313e585a81cd0
.exe windows:4 windows x86 arch:x86

5e66c148d219a67d719f604c98e64690

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord823
ord924
ord540
ord2846
ord2818
ord537
ord2764
ord2915
ord6648
ord4129
ord800

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
printf
rand
srand
time
_except_handler3
fopen
fwrite
fclose
__CxxFrameHandler
strncmp
atoi
strstr
exit
sprintf
_ltoa
_strcmpi

kernel32

SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
CreateThread
GlobalMemoryStatus
GetVersionExA
GetModuleFileNameA
GetStartupInfoA
GetModuleHandleA
GetSystemDirectoryA
DeleteFileA
GetLastError
lstrlenA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
CloseHandle
GetDriveTypeA
ExitThread
Sleep
GetCurrentProcessId
GetTickCount
HeapAlloc
GetProcessHeap
ResumeThread
CreateProcessA
CopyFileA

user32

wsprintfA

comdlg32

GetFileTitleA

advapi32

CreateServiceA
OpenServiceA
OpenSCManagerA
SetServiceStatus
RegisterServiceCtrlHandlerA
ControlService
StartServiceCtrlDispatcherA
RegOpenKeyExA
CloseServiceHandle
RegCloseKey
RegSetValueExA
RegOpenKeyA
DeleteService
StartServiceA

ws2_32

sendto
inet_addr
htons
setsockopt
WSASocketA
WSAStartup
gethostbyname
gethostname
htonl
connect
socket
send
inet_ntoa
closesocket
WSAGetLastError
recv
__WSAFDIsSet
select

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5e66c148d219a67d719f604c98e64690

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

comdlg32

advapi32

ws2_32

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 243KB

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 243KB