6ff207931a6f291fbdd9e69b6bc06135 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6ff207931a6f291fbdd9e69b6bc06135
Size

22KB
MD5

6ff207931a6f291fbdd9e69b6bc06135
SHA1

0f0b893a6eef20584fc9a2b7810ea1ee6e59a1dc
SHA256

03c17647313cf0f1b133d98b9e324de36fce8bcdc6b644768037aea4f4076eb5
SHA512

bad792b8776444e2b5ec59d1c04a1eadb63922eece90aa61eea04a6ebb770ea2c5d3efb5a245717d047a5d60065a1e79e6858bdd0a566256bcc8d8128dec85a4
SSDEEP

384:PIlg/ZhLzIt2LhV0BRZXH4RWIqTYYjl/J0hnYJuAeT+ClPd45kSgp9Y15qRtpHeW:kgBhfIty4CEjl/3QPd45WY18pUKfZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ff207931a6f291fbdd9e69b6bc06135

Files

6ff207931a6f291fbdd9e69b6bc06135
.exe windows:4 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE