12eaaaa930a4580b577a6521de64c77b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

12eaaaa930a4580b577a6521de64c77b
Size

16KB
MD5

12eaaaa930a4580b577a6521de64c77b
SHA1

8af24265ea1924eeecb2603ba6266081f8857af0
SHA256

f9c3b968d512a9ee5d89e6a89706fa30a306ae0bd594bbf88aab9eb30c5d3574
SHA512

55fff07d7ed6383c05cd54e5fe0c79fdfe0f3885f788ebf2057a087b057738cd44d7247b04ed5328d3cf9008378289fcb5a5b1d614cc757ca0e372bd4f108726
SSDEEP

384:6PRXyefylVgymMIIOzlR3h1Klc81640TjBuPWG:6PR9fSghMIIOC+5I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12eaaaa930a4580b577a6521de64c77b

Files

12eaaaa930a4580b577a6521de64c77b
.exe windows:4 windows x86 arch:x86

d51a0f5e945625cbaa9318d3ba3e0583

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

listen
accept
inet_addr
bind
WSAStartup
gethostbyname
socket
setsockopt
htons
inet_ntoa
connect
WSAGetLastError
closesocket
select
__WSAFDIsSet
send
recv
shutdown

kernel32

DeleteCriticalSection
InitializeCriticalSection
GetTickCount
GetCurrentProcessId
CreateThread
GetCommandLineA
CreateMutexA
GetLastError
GetCurrentThreadId
Sleep

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

msvcrt

_snprintf
rand
realloc
atoi
strchr
strstr
_time64
_fullpath
free
sscanf
strncpy
srand
strtok
malloc
strrchr
sprintf
exit
_open
gmtime
strncmp
isdigit
_strrev

Exports

Exports

time

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE