SecuriteInfo[.]com[.]Trojan[.]DownLoader32[.]59441[.]8951[.]18837[.]exe | Triage

Sharing

General

Target

SecuriteInfo.com.Trojan.DownLoader32.59441.8951.18837.exe
Size

609KB
MD5

93b8f1a3a017113d7f767181cb8bd9fb
SHA1

d76c679e7bc56a43c71a185da844edc75f92be5d
SHA256

e8d71d3d7f16bd4af56900e3fc813d604fdfafd47e86172804f0152c2c227a82
SHA512

12946b7c64a634e3d0621e94d5bd4e5c034277ec216bfd8aa78f37eb1176eda327ffc2caccdcfde0a12c8f8fc508e4e5e68e5bf64cfd4764715fb2ee424b3a41
SSDEEP

12288:mf5D2h2wDEt84epFZ/lmlQHROdz+eBkWgQFX89wue0f:M502FGTmmRI3fue0f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.DownLoader32.59441.8951.18837.exe

Files

SecuriteInfo.com.Trojan.DownLoader32.59441.8951.18837.exe
.exe windows:5 windows x64 arch:x64

48e414e431433a62713440d22abb8343

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

gethostbyname

winmm

mixerOpen

version

VerQueryValueW

comctl32

ImageList_Create

psapi

GetModuleBaseNameW

wininet

InternetOpenW

user32

GetDC

gdi32

BitBlt

comdlg32

GetSaveFileNameW

advapi32

RegCloseKey

shell32

DragFinish

ole32

CoGetObject

oleaut32

SafeArrayGetLBound

Sections

.MPRESS1
Size: 430KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE