2ad6d4cab9754269995174c7e181cbd4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ad6d4cab9754269995174c7e181cbd4
Size

24KB
MD5

2ad6d4cab9754269995174c7e181cbd4
SHA1

195d75056351e7d364b203fad45a524797c79054
SHA256

59930a8b22f8169c9207a76f7b9e941d317ebbbf0db754a4bca46af7d9516859
SHA512

149493bb84684fbe7d3f07e53739993c5306212cee07a61db4e21e55470c13c55ed9909133123533b0c2c712f15fca7b3a7ef3e9be2521daf5d538caaf73745e
SSDEEP

384:XWfeNcHTPQaFk2zno5ArMK/AOQtLCH/EY:XW+c9FPo4MKzDZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ad6d4cab9754269995174c7e181cbd4

Files

2ad6d4cab9754269995174c7e181cbd4
.exe windows:4 windows x86 arch:x86

0e5a3d97cec22c99904bce194d03e9e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_addr
htons
socket
sendto
WSAStartup

iphlpapi

GetAdaptersAddresses

kernel32

GetEnvironmentVariableA
lstrcmpiA
OpenMutexA
CloseHandle
GetProcessHeap
HeapAlloc
HeapFree
lstrcpyA
IsBadWritePtr
lstrlenA
Process32Next
lstrcatA
TerminateProcess
OpenProcess
GetCommandLineA
Process32First
CreateToolhelp32Snapshot
ExitProcess
GetLastError
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess

advapi32

CheckTokenMembership
AllocateAndInitializeSid
FreeSid

shell32

ShellExecuteExA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE