8b5ad6a61bfdb73ada2965304357f71b | Triage

Sharing

General

Target

8b5ad6a61bfdb73ada2965304357f71b
Size

24KB
MD5

8b5ad6a61bfdb73ada2965304357f71b
SHA1

606081458c859e0957a9f7d4f099021e7aaba465
SHA256

9fe3cbbc4edf88f86ac1ec99c3cb3f39f19f7bf139fad290f0ad593214fb6d83
SHA512

53ac7755440158e0786be054537276de10eea2c68141a3e17cd66546af48dda63a98fa86e4d57e0f0f5e175f8a3cd626389921bd6c2c459952542f753887b3d0
SSDEEP

384:ld79bgvfCaI8Ho5Wc+21hjU1+swprzreJTaeG7/m4msFYwtM/KMXEQ0fX0Bp:T7ofdpgLswoQq4LdM/KMUDkBp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b5ad6a61bfdb73ada2965304357f71b

Files

8b5ad6a61bfdb73ada2965304357f71b
.exe windows:4 windows x86 arch:x86

690bfab8e14f75d9b996a8e13c14e2a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

IsValidURL
CreateAsyncBindCtx
DllCanUnloadNow
IsAsyncMoniker
ZonesReInit
IsValidURL
URLDownloadW

wsock32

htons
sethostname
WSAStartup
ioctlsocket
bind
htonl
SetServiceA
gethostbyaddr
listen

user32

CloseDesktop
DrawStateA
FlashWindow

Sections

.text
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE