70c9988e1894ff05fa180b16298f2b40 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70c9988e1894ff05fa180b16298f2b40
Size

15KB
MD5

70c9988e1894ff05fa180b16298f2b40
SHA1

6b676f49c7636bcd781bdbf216d3b5c0790fcf7c
SHA256

d4fe7fd5456f3a20fde3d2b02a2378d6bf4eb0f61a099f3093091de20d3c095d
SHA512

c49377c08e9247b07c5e58d2febeca21658e6ed5d9b2ba6a106556f05151b9738ce073ee95ae454df95c99ce682362255220b7b24f18ba8aadbcecd1507c05ff
SSDEEP

384:minM9cOnUX8Z7TwPmjp0jKOBmJVC5s+eL8B+qty/cQ8Ay:maM9/nY8ZQPU0jh8CuwicQ8Ay

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70c9988e1894ff05fa180b16298f2b40

Files

70c9988e1894ff05fa180b16298f2b40
.exe windows:4 windows x86 arch:x86

68b4889cf23c593a42482ccce795b589

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
GetCommandLineA
GetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleA
CreateProcessA
ExitProcess
CopyFileA
lstrcatA
lstrcpyA
lstrcpynA
lstrlenA
GetSystemDirectoryA
MoveFileA
Sleep

user32

SendMessageA
GetMessageA
LoadCursorA
DlgDirListA
PostQuitMessage
RegisterClassExA
FindWindowA
ShowWindow
UpdateWindow
DispatchMessageA
DefWindowProcA
wsprintfA
CreateWindowExA
LoadIconA

advapi32

RegOpenKeyA
RegSetValueExA

shell32

ShellExecuteA

ws2_32

htons
WSACleanup
WSAStartup
accept
bind
closesocket
WSAAsyncSelect
listen
recv
send
socket

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE