0ba104d752eb63194c356c309196c710 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ba104d752eb63194c356c309196c710
Size

12KB
MD5

0ba104d752eb63194c356c309196c710
SHA1

a1193509a0a1011513d569a712c1a5ae31a95403
SHA256

5b715e92c6b39f6fc80f3513da7a8d1448591e4397fee4d69f2ea47863f49357
SHA512

56cc41587347840062107cdbcf601640690f03a0ef526a014f5b338db0151d4f77c54602e1f5a00ed3a3001906c5b180dbe978c57981b95538edc41bd799866d
SSDEEP

192:T/n0wCLj7P1oynS/kgJK5uxyYBWYgSjfKj3f3rNS/KY:lCLP1E//JK5uxybBsD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ba104d752eb63194c356c309196c710

Files

0ba104d752eb63194c356c309196c710
.exe windows:4 windows x86 arch:x86

dbe4a1b68d083e60c6f1bde24b348c9f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
OpenProcess
TerminateProcess
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateThread
GetStartupInfoA
GetModuleHandleA

ws2_32

WSAStartup
socket
htons
bind
listen
accept
recv
closesocket
send

msvcrt

_stricmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
??3@YAXPAX@Z
sprintf
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_strnicmp

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE