19b532a677fd50356fda0d0e67649ff9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

19b532a677fd50356fda0d0e67649ff9
Size

13KB
MD5

19b532a677fd50356fda0d0e67649ff9
SHA1

fe977c1283b9312594a6c964f1064175620fdec2
SHA256

b871f240ced185e1fcb760199dfdc073247b001aedaf2bff34b05ae7b11ac207
SHA512

2c467e36add66690c93878a9597a3daf575da57c7cfc1b6584fbc9667e6d52308cec915b551f21f90b139fed80e5d10f8b371bab6a1bc131c2fbe85243bde55b
SSDEEP

384:gOWPyNFMBvYiJ69EMFtUDd4ahO645qS9wFrKv:iqrevJ8FtUDl05qS9AKv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19b532a677fd50356fda0d0e67649ff9

Files

19b532a677fd50356fda0d0e67649ff9
.exe windows:4 windows x86 arch:x86

3d56f8947d7a618895f8b430a490099e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

LocalFree
LocalAlloc
ExitProcess
lstrlenA
Sleep

wsock32

socket
recv
gethostname
closesocket
WSAStartup
connect
send

advapi32

RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE