14e59a5f52eda4d60e434332b67b2562

Sharing

Copy URL Twitter E-mail

General

Target

14e59a5f52eda4d60e434332b67b2562
Size

32KB
MD5

14e59a5f52eda4d60e434332b67b2562
SHA1

152cac36fc61e6d99f288d23e3599b45efbbd68e
SHA256

bc1a58829c57de2391d9e7b48d27a22dbce0171c766e3f76bf0134dcd5b43d29
SHA512

0fddd3be79395af446d1313509de29fc0b7010ee5e5820d22183d5f9beaffa795c4df41b3e02a8101383f832840ae739281310a272c9e8271c4e0a369e3ee9d7
SSDEEP

384:36IqLbwBADIjDKfQLiItUXkSVOdFKt+b3341+b3BnF7H1nImjYE0W:ZabFkePnX9s7KtyKy11H1I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14e59a5f52eda4d60e434332b67b2562

Files

14e59a5f52eda4d60e434332b67b2562
.exe windows:4 windows x86 arch:x86

13178d418216ad60acced34c06120e15

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
recv
WSACleanup
WSAGetLastError
closesocket
WSAStartup
socket
htons
connect
send
WSAAsyncSelect

kernel32

FreeLibrary
LocalFree
MapViewOfFile
CloseHandle
UnmapViewOfFile
GetCurrentProcess
GetVersionExA
GetTickCount
GetLastError
CreateMutexA
LoadLibraryA
DeleteFileA
ExitProcess
GetModuleFileNameA
GetSystemDirectoryA
SetPriorityClass
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteFile
CreateFileA
Sleep
ResumeThread
CreateThread
WinExec
lstrcatA
lstrcpyA
MoveFileA
GetProcAddress
GetComputerNameA
SetFileAttributesA
GetCurrentProcessId
HeapAlloc
GetProcessHeap
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
CopyFileA
GlobalMemoryStatus

user32

wsprintfA
DefWindowProcA
ExitWindowsEx
PostQuitMessage
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA

advapi32

ControlService
CloseServiceHandle
StartServiceA
OpenSCManagerA
OpenServiceA
ChangeServiceConfigA
RegOpenKeyExA
RegRestoreKeyA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
QueryServiceStatus

msvcp60

??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

msvcrt

strstr
_itoa
atoi
strncpy
rand
__CxxFrameHandler
printf
fclose
fprintf
fopen
sprintf
malloc
_strlwr
strcspn
_stricmp

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

13178d418216ad60acced34c06120e15

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

msvcrt

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 10KB - Virtual size: 10KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 10KB - Virtual size: 10KB