2d66c95d2c5c6419d081a13bda3119c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d66c95d2c5c6419d081a13bda3119c9
Size

77KB
MD5

2d66c95d2c5c6419d081a13bda3119c9
SHA1

1918994a1a6e11688bc09a4e9b500ca37bf3bcac
SHA256

dce9a807c64acada15914e65ab38941fb68b45111ee6ac4ee528bd2614c35612
SHA512

afff9d223568728c0c1334fa9227c6539f816e58664e606c77d81776e062f897ce10c0c515fae1b67ea33feb968c6ce1bfb550a90105d79bc8c329dfdc394ddd
SSDEEP

1536:AkOHrz/NM/XAzsj0mvamAsWbEzl/IfguXzBBdGTpYnhc4iWwLSK7Ru:AkOHrr2jjxamABBQTKnhIHA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d66c95d2c5c6419d081a13bda3119c9

Files

2d66c95d2c5c6419d081a13bda3119c9
.exe windows:4 windows x86 arch:x86

dbd132c1b3b6af06b897100388f452cc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpA
GetModuleFileNameA
SetPriorityClass
GetCurrentProcess
WriteFile
CreateFileA
LockResource
LoadResource
FindResourceA
CreateThread
ExpandEnvironmentStringsA
GlobalMemoryStatus
GetSystemTime
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
GetVersion
ExitProcess
Sleep
GetVersionExA
lstrlenA
GetSystemDirectoryA
CreateProcessA
CloseHandle
CopyFileA
TerminateProcess

user32

wsprintfA

advapi32

RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegSetValueExA
RegFlushKey
GetUserNameA

ws2_32

send
connect
htons
inet_addr
gethostbyname
socket
accept
inet_ntoa
recv
bind
htonl
WSAGetLastError
__WSAFDIsSet
ioctlsocket
select
WSAStartup
closesocket
listen

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ