0c2c91c94f0689a947996612ae91bd42 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c2c91c94f0689a947996612ae91bd42
Size

3KB
MD5

0c2c91c94f0689a947996612ae91bd42
SHA1

c521d3131eff1f4c8481085121c8224f94886628
SHA256

c3f5ba91c90daa57dc495e16c61fa084fa09782489faeac13e1f3d04b87a3402
SHA512

bfffb86e2a34a8c0b3a72b1a311965004165e1c1f5a8d31245817239819cce1379887e440b08b65d484de6bd7f319e80befa5855e29f7d1509a96c1a126f936f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c2c91c94f0689a947996612ae91bd42

Files

0c2c91c94f0689a947996612ae91bd42
.exe windows:4 windows x86 arch:x86

3dbebb70020057a29d8be74dd016c1b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA

kernel32

CreateMutexA
CreateRemoteThread
CreateToolhelp32Snapshot
ExitProcess
GetCommandLineA
CloseHandle
GetProcAddress
LoadLibraryA
OpenFile
OpenMutexA
OpenProcess
Process32First
Process32Next
Sleep
GetLastError
Thread32First
Thread32Next
WinExec
WriteFile
SuspendThread

wsock32

socket
connect
WSAStartup
send
gethostbyname
recv

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

StrStrIA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE