ballsack e[.]exe | Triage

Sharing

General

Target

ballsack e.exe
Size

36KB
MD5

644f18453d3e3874b8cd64374dcebc9e
SHA1

0118997f0114b4a1f090f35d6321d43fe036951a
SHA256

42013a222c8b3840f8242c0664f46fa3776b9e1cddae157fd208d15ba2c49055
SHA512

81bb87a9295587999d9b2661a92615a235084d44dedbf726f7fffc3db693d42847e85ca9cf4420297214120703e291bef29be9f3b057f9851acaf45f0e32b31e
SSDEEP

768:PNnmZ/8vPlLUdhfJ8v6utFpVsuRregrWChgzub7Dsr1:Fnwu4DejVLyOhgzuYr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ballsack e.exe

Files

ballsack e.exe
.exe windows:4 windows x86 arch:x86

d01b793cfeabb1210a9dfd924e5cbf0d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

SendInput

gdi32

DeleteDC

advapi32

RegCloseKey

shell32

ExtractIconA

msvcp60

??0_Winit@std@@QAE@XZ

msvcrt

_iob

winmm

waveInOpen

shlwapi

PathFileExistsA

ws2_32

htons

urlmon

URLDownloadToFileA

gdiplus

GdipFree

wininet

InternetOpenA

Sections

.MPRESS1
Size: 28KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE