6324f3fb88fbf82122135eacfb634cca | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6324f3fb88fbf82122135eacfb634cca
Size

24KB
MD5

6324f3fb88fbf82122135eacfb634cca
SHA1

0699a0a1c2a263b605c034a3329689d573c65515
SHA256

cb8265e3e85d855dd44ad62b5580a3abc71ab63d3433675ddd9b93c40ba85bfd
SHA512

23941c47faf43401f3ac712da0e01647d995af97b9a615e0180a07fedbef4ae604a6ed33ea875de18dad701a2a234240a116bc1c316c9ca25636a31229180b76
SSDEEP

384:nxUwGdYrtup53fYZp3YBLgb+IW9C42Z4EWhu20dmQJLQYIG6ok2Wdo3pWvOp:nxvGaa5sp3gkb+IWoGEBbWYSokTWsWp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6324f3fb88fbf82122135eacfb634cca

Files

6324f3fb88fbf82122135eacfb634cca
.exe windows:4 windows x86 arch:x86

690bfab8e14f75d9b996a8e13c14e2a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

IsValidURL
CreateAsyncBindCtx
DllCanUnloadNow
IsAsyncMoniker
ZonesReInit
IsValidURL
URLDownloadW

wsock32

htons
sethostname
WSAStartup
ioctlsocket
bind
htonl
SetServiceA
gethostbyaddr
listen

user32

CloseDesktop
DrawStateA
FlashWindow

Sections

.text
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE