1e1b61488d57e05556f68693bea1739c

Sharing

Copy URL Twitter E-mail

General

Target

1e1b61488d57e05556f68693bea1739c
Size

267KB
MD5

1e1b61488d57e05556f68693bea1739c
SHA1

a0568dabda1ea99c084e5ef85b9941e8f18c74b6
SHA256

3eb3f90f8c8deace0b58f2951b5e6f1c2aa8735aa281424d03c4368d492f63ef
SHA512

fbfcc3cf513f5a3a52957cb038f19b781ac118a48846e000f8058619c5d8d3e1e42c5b9cc0cdc46bfcf6c0a6642b9782f73378ad115ccee5a2ffeaa49b895e4c
SSDEEP

3072:wBPs0iwwmcZVIRuJiNkx4ZS9yZ2TElG5FG9DEBLLvU35:qPs0iwwmcvukxB9u2TH7GNEB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e1b61488d57e05556f68693bea1739c

Files

1e1b61488d57e05556f68693bea1739c
.exe windows:5 windows x86 arch:x86

d62a229cd388c9303333c0997ec49c92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
GetLocaleInfoW
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLastError
HeapFree
HeapReAlloc
HeapAlloc
GetModuleHandleW
GetProcAddress
ExitProcess
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
FatalAppExitA
VirtualAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
CloseHandle
MultiByteToWideChar
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
WriteFile
GetModuleFileNameA
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetFileAttributesA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetEnvironmentVariableA

libeay32

ord808
ord809
ord784

ws2_32

accept
closesocket
shutdown
inet_addr
gethostbyname
listen
htons
socket
ioctlsocket
connect
select
recv
send
bind
htonl
WSAStartup
inet_ntoa

rpcrt4

UuidFromStringA

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d62a229cd388c9303333c0997ec49c92

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

libeay32

ws2_32

rpcrt4

Sections

.text Size: 215KB - Virtual size: 214KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 7KB - Virtual size: 72KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 3KB

.text
Size: 215KB - Virtual size: 214KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 7KB - Virtual size: 72KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB