09ef9c7c46615446fc82d9329324e76c[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09ef9c7c46615446fc82d9329324e76c.exe
Size

86KB
MD5

09ef9c7c46615446fc82d9329324e76c
SHA1

ec69d67c4f0bca2635979204899533be2c3adb0c
SHA256

faff01e2c4f1e0bcc586a175d9aba48e0acd2ef0851e86ee3dae6679b3fc79dc
SHA512

7eaec677faff99b23fbb3d4c08ba920bdc83406fd407c471be764ce9c6f818578b832f131a8e784f19eb9e5aee0862ab2fbc67ca6fe02dd2e02dbc606fbdab4a
SSDEEP

1536:bdZbeVN/YquODOwhnyPwBhKHxjTkMgWaFlL3QOPFyIQtlN71Otn:RZqVlY2OwhXKZgMgDnJA71Gn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09ef9c7c46615446fc82d9329324e76c.exe

Files

09ef9c7c46615446fc82d9329324e76c.exe
.exe windows:4 windows x86 arch:x86

799e260a62475623ddf80b12faa9e043

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
lstrcmpA
GetModuleFileNameA
SetPriorityClass
GetCurrentProcess
WriteFile
CreateFileA
lstrlenA
CreateThread
GetSystemDirectoryA
CopyFileA
GetSystemTime
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
GetVersion
LockResource
CreateProcessA
FindResourceA
CloseHandle
LoadResource
GetVersionExA
ExitProcess
TerminateProcess

user32

wsprintfA

advapi32

RegFlushKey
RegCreateKeyExA
RegSetValueExA
RegCreateKeyA
RegCloseKey

ws2_32

bind
connect
htons
inet_addr
gethostbyname
socket
accept
recv
listen
send
htonl
WSAGetLastError
__WSAFDIsSet
ioctlsocket
select
WSAStartup
closesocket
inet_ntoa

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ