542613b6083e6cda690c49041d85dc49 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

542613b6083e6cda690c49041d85dc49
Size

7KB
MD5

542613b6083e6cda690c49041d85dc49
SHA1

58f7f17c40ca5af2c3016b85c0a6c368739bc663
SHA256

ce5f64be9e2d69d638b2a9f9ec4a68910e3cf776a2003e92e7bf6c862b275220
SHA512

f7300190240779966125cb09592640640763f3efdf88062063c577b7489ebe4b82dc362c36c393d019513258fc013fc5dea03dfb071bce1bbdbc4355d2361f9c
SSDEEP

96:t4Pc2C49T/jIAOru4bHMK+xWloEfByYq3jsih1wvwZBkgsKOhjv2Hblh4:z2fR/jIAOboDYllYYSQih1EK1C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
542613b6083e6cda690c49041d85dc49

Files

542613b6083e6cda690c49041d85dc49
.exe windows:1 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 20B - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE