205cbb2b4640cd509263b891e6178f17 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

205cbb2b4640cd509263b891e6178f17
Size

8KB
MD5

205cbb2b4640cd509263b891e6178f17
SHA1

40bd65902813925558cd172e62bc1a8ef032d261
SHA256

64132949d68ede36e12f731ba00ec9987f00074ff6f95fb1aa1c4994b8f545c0
SHA512

88e3a88196bbdfe43b0ffb46f3c85aeaf0cc6531fc2944f0ce36c9f15b4784a7adc440e6919b6a21575a198f2d783fe8f2f7e390b317aaf226c48294a4efa615
SSDEEP

192:nKvck8YarPQnLtTCPZy5fCN+yZY2NpRGvUu/p8DZx:nKvcXPSTCPM5CNHpGvUu/pKZx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
205cbb2b4640cd509263b891e6178f17

Files

205cbb2b4640cd509263b891e6178f17
.exe windows:5 windows x86 arch:x86

e2f14eac1917776fe474971288981cf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
inet_addr
ioctlsocket
WSAGetLastError
htons
recv
socket
select
closesocket
gethostbyname
send

shlwapi

SHSetValueW

kernel32

GetTickCount
Sleep
GetModuleHandleW
CreateThread
LocalFree
CloseHandle
ReleaseMutex
CreateMutexA
lstrcatW
LocalAlloc
GetLastError
lstrlenW
GetModuleFileNameW
GetFileAttributesW
ExitProcess
lstrlenA
CreateProcessW
WaitForSingleObject
CopyFileW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE