1bb60132f3f5f488b87603471ec63381

Sharing

Copy URL

Twitter E-mail

General

Target

1bb60132f3f5f488b87603471ec63381
Size

104KB
MD5

1bb60132f3f5f488b87603471ec63381
SHA1

1a2e5fcf1ddf7d9d7c332609a29c90c7760e3986
SHA256

002c29422910cd5ce806e57b723f3f23bb6626c70a454b7d9f8da91c9bc7b673
SHA512

49981ef0d90990ee7edc5c3c2adfe89d5450bf329bf5e321655f4a7f602f1dc627624f8698c9db3314f13bc791a8bc0a9a9c1f71e1a8aa851b3c15a258dfa991
SSDEEP

768:dXzRlcG9UEFwPivO7X4WyryLsFI9nlYBMpfSGInK2x20qhuEyVggllLZU9QZU9m:5Rlx6EzcX4WyqsFyYsaGIG4LVllLz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bb60132f3f5f488b87603471ec63381

Files

1bb60132f3f5f488b87603471ec63381
.exe windows:4 windows x86 arch:x86

bb970928839a57dc4fd0ad09f100d692

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSAStartup
WSACleanup
ioctlsocket
gethostbyname
gethostbyaddr
socket
getservbyname
htons
connect
closesocket
send
recv

kernel32

SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
GetCPInfo
CompareStringA
MultiByteToWideChar
GetVolumeInformationA
GetLastError
CreateDirectoryA
GetStringTypeA
GetModuleFileNameA
MoveFileExA
Sleep
InitializeCriticalSection
DeleteCriticalSection
FormatMessageA
LeaveCriticalSection
SetLastError
InterlockedExchange
RtlUnwind
GetStringTypeW
SetEndOfFile
GetLocaleInfoA
LCMapStringA
GetFileAttributesA
ReadFile
LoadLibraryA
CreateFileA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetStartupInfoA
GetCommandLineA
GetVersionExA
WriteFile
LCMapStringW
HeapFree
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
WideCharToMultiByte
HeapAlloc
GetTimeZoneInformation
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
SetFilePointer
FlushFileBuffers
SetStdHandle

user32

wvsprintfA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegDeleteValueA

shell32

ShellExecuteA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb970928839a57dc4fd0ad09f100d692

Headers

File Characteristics

Imports

wsock32

kernel32

user32

advapi32

shell32

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 48KB - Virtual size: 47KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 48KB - Virtual size: 47KB