650db2914db58350823b9235f94972d9 | Triage

Sharing

General

Target

650db2914db58350823b9235f94972d9
Size

17KB
MD5

650db2914db58350823b9235f94972d9
SHA1

17f8da68b94988a523d135e5f9bc1b1c65e3c0e1
SHA256

20ef6c38ce6d19a2081ef0b2dd399e1556dfe79b5eba8c71427ba9e34faaf3fe
SHA512

596008e4f41724c7232ebe764ee0bf6b0f751b5c2ef1eb17dfcb2908823d92776502b38193a12776b6cf8eae379bed89c9721cfde9a9d7c4266ccef2ed7ad2c5
SSDEEP

384:Vg2k6vmr36015I8UXyJhYwHdo9VcxFYe:VgRJnPg0YwHdo9q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
650db2914db58350823b9235f94972d9

Files

650db2914db58350823b9235f94972d9
.exe windows:4 windows x86 arch:x86

9732ac678aa6876ffe18938c1226284d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
CloseHandle
ReadFile
lstrcmpA
CreateFileA
UnmapViewOfFile
CreateThread
WriteFile
lstrlenA
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
FreeResource
LockResource
GetTickCount
LoadResource
FindResourceA
WinExec
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RtlUnwind
HeapFree
GetProcessHeap
HeapAlloc
SetFilePointer
LoadLibraryA
SizeofResource
GetProcAddress

user32

CharLowerA
RegisterClassExA
CreateWindowExA
wsprintfA
GetWindowTextA
GetForegroundWindow
DispatchMessageA
TranslateMessage
GetMessageA
DefWindowProcA

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueExA

wsock32

ioctlsocket
socket
WSAStartup
connect
recv
send
closesocket
gethostbyname
inet_addr
htons

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ