1a9de195637049c0913e9c6caffa4cfa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a9de195637049c0913e9c6caffa4cfa
Size

33KB
MD5

1a9de195637049c0913e9c6caffa4cfa
SHA1

af2b6ea21ea9cad99c4287582c4e8d4c8ad675ac
SHA256

43a84ee5fe6da8462ec6f5bb5fef2b2f7fd58143b2443d843634607252770c17
SHA512

48c6e6d4eccb77a6ff33f36f65e7eb66d6e3e7b198b7602565175aab82938086a15778689480846bf2af8991bb8a2b0b12c71f54feb16ac7f5e8178bdf1bc1ef
SSDEEP

768:0tE868R8Z8s888m8E8QvZ7IQB4xxEMyjqB0+z48Pxuqn/AfbT7NgFtT7Lil:0tEzq+5hRpfvZ7IQB4x6MQquR8ZuXvYE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a9de195637049c0913e9c6caffa4cfa

Files

1a9de195637049c0913e9c6caffa4cfa
.exe windows:4 windows x86 arch:x86

82823d7eb2fb2902c5c7bc721c3da49d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
memmove
strlen
strcpy
strcat
atof
_stricmp
_CIlog
floor
ceil
_CIpow
_CIexp
malloc
free
fseek
ftell
fread
fclose

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
ReadFile
GetLastError
CreateFileA
SetFilePointer
SetEndOfFile
HeapAlloc
WriteFile
FreeLibrary
LoadLibraryA
GetProcAddress
HeapReAlloc

wsock32

recv
closesocket
WSACleanup
WSAStartup

Sections

.code
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ