6478e0769e17f6c1f5fee02413f045e6 | Triage

Sharing

General

Target

6478e0769e17f6c1f5fee02413f045e6
Size

39KB
MD5

6478e0769e17f6c1f5fee02413f045e6
SHA1

ae865a92c6510a8708ae7f7eb9fd3d3e98fbe0fa
SHA256

75ed8990ed2ba13f933517ce5abeacbae1bf14cd0b926b4314986046d4e0ff53
SHA512

e00b9c6d7ba7209b8788c01c8da914fbf6afb02552e9205f23b2c9097ef27f9a7a4635d7740dfa4d98f32dd0f09e35bd518da642280a29821b7245fbc14448bb
SSDEEP

768:fzj/FQ/NOdd0oon7dHWtSnZI45JVm/xY/+GX6hP:PKQreZHXn2kVP/X6hP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6478e0769e17f6c1f5fee02413f045e6

Files

6478e0769e17f6c1f5fee02413f045e6
.exe windows:1 windows x86 arch:x86

fbb66d787f04ffe185c1465fad6513b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
accept
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE