1fc5643cf8b1623b19242ec7d3631d1d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1fc5643cf8b1623b19242ec7d3631d1d
Size

50KB
MD5

1fc5643cf8b1623b19242ec7d3631d1d
SHA1

e0318f2cb40945ab164306872caaeb10526062ca
SHA256

3c5e719d99423774f549f3b92949df92b8d3c7ad8cc9d3d4621ba6c15aac1c93
SHA512

de4d8bc75189136f14d8bba9d6414b50bfd05697a0e6e6b9f1f25131ccd11397649c2b15903249680c0271bdc6fe33ade71f6319fb9d6a1c28c6610342e7e08b
SSDEEP

1536:xSLKtww+lyDiClPJ5PSOaYoBmNj3igDFn4ObC:/t+QOSPPPSaomnDF7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fc5643cf8b1623b19242ec7d3631d1d

Files

1fc5643cf8b1623b19242ec7d3631d1d
.exe windows:4 windows x86 arch:x86

fbb66d787f04ffe185c1465fad6513b0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
accept
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE