1fd0cbc4de1d160c065dd93612250e1f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1fd0cbc4de1d160c065dd93612250e1f
Size

5KB
MD5

1fd0cbc4de1d160c065dd93612250e1f
SHA1

ce1c07e741383309306f78fc9677e159b4b70fe6
SHA256

4cac0c9676853f1ec6b0f3c2eeb0149e02f70fc749b7ce66945f1eb570f7b177
SHA512

cd061b22b5b0f33600405011ad2870b8d49d38d60492b01009cee29e459fb27e763adb350e22a1504d47e564d561f46d5646aea83217db0690e5f5e92f047268
SSDEEP

48:6QJUH7WIQFbwttql3KDIKe9LperprSlGvVjTBDif0qjev7:sinF8Cebe9mr7TdiM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fd0cbc4de1d160c065dd93612250e1f

Files

1fd0cbc4de1d160c065dd93612250e1f
.exe windows:4 windows x86 arch:x86

6e7dd1cdafe9478d822ef6605ecd22c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

LoadLibraryA
LocalAlloc
LocalFree
GetProcAddress
WideCharToMultiByte
lstrcatA
lstrcmpiA
lstrlenA
FreeLibrary
ExitProcess
Sleep

wsock32

socket
send
recv
gethostname
connect
closesocket
WSAStartup

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueExA
RegQueryValueExA

ole32

CoTaskMemFree

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 742B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE