97688a4b2d3f2f20ea4388deeccdcc72

Sharing

Copy URL Twitter E-mail

General

Target

97688a4b2d3f2f20ea4388deeccdcc72
Size

58KB
MD5

97688a4b2d3f2f20ea4388deeccdcc72
SHA1

ec9ab8a8fc1b9f7fed7bf3b643f560ef517d447f
SHA256

bede1e3420c97c59a609f07891c496997780889d02faf7c1c5ecd8f88849a43a
SHA512

527e73bcca4ec73cc1f579f5e5fcc2fa5eb08bacfdc520ac547c915dc11d47d4150b4b126b7977cad92e37c9396665ab9c8afdae0fc73f9391637870e747864b
SSDEEP

768:w63NuYMRKgiHwIqc+jL/+7TFt5Afsz4S9ZHqP9kqu0orl1iomZ/vTtWCoB9xnurb:d5SK/anMidPCWo51ijvTQDxnunVe5BQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/12201931626/Release/PortShell.exe

Files

97688a4b2d3f2f20ea4388deeccdcc72
.rar
12201931626/CmdHeader/CleanEvent.h
12201931626/CmdHeader/DebugReg.h
12201931626/CmdHeader/Execute.h
12201931626/CmdHeader/Process.h
12201931626/CmdHeader/Service.h
12201931626/CmdHeader/Shell.h
12201931626/CmdHeader/Shutdown.h
12201931626/CmdHeader/Sysinfo.h
12201931626/CmdHeader/TermService.h
12201931626/CmdHeader/User.h
12201931626/CmdHeader/Wget.h
12201931626/Include/IPhelp/IPExport.h
12201931626/Include/IPhelp/IPHlpApi.Lib
12201931626/Include/IPhelp/IPHlpApi.h
12201931626/Include/IPhelp/IPTypes.h
12201931626/Include/IPhelp/Ipifcons.h
12201931626/Include/IPhelp/Ipinfoid.h
12201931626/Include/IPhelp/IpmConv.h
12201931626/Include/IPhelp/IpmcDefs.h
12201931626/Include/IPhelp/Iprtrmib.h
12201931626/Include/IPhelp/IpxConst.h
12201931626/Include/IPhelp/Ipxrip.h
12201931626/Include/IPhelp/Ipxrtdef.h
12201931626/Include/IPhelp/Ipxsap.h
12201931626/Include/IPhelp/Ipxtfflt.h
12201931626/Include/IPhelp/LMcons.h
12201931626/Include/IPhelp/Mprapi.h
12201931626/Include/IPhelp/_Entryid.h
12201931626/Include/PSAPI.LIB
12201931626/Include/Psapi.h
12201931626/Include/StdAfx.cpp
12201931626/Include/StdAfx.h
12201931626/Include/ipexport.h
12201931626/Include/iphlpapi.h
12201931626/Include/iptypes.h
12201931626/PortShell.cpp
.js
12201931626/PortShell.dsp
12201931626/PortShell.dsw
12201931626/PortShell.h
.js
12201931626/Release/PortShell.exe
.exe windows:4 windows x86 arch:x86

968157287d0057b6db139d362b2e7fc1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleFileNameExA
EnumProcessModules

ws2_32

setsockopt
send
socket
htonl
htons
WSAStartup
bind
listen
closesocket
accept
ntohs
select
recv
inet_ntoa
WSACleanup

advapi32

EnumServicesStatusA
CloseServiceHandle
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
ControlService
DeleteService
OpenServiceA
QueryServiceConfigA
QueryServiceStatus
OpenSCManagerA
OpenProcessToken
RegCloseKey
OpenEventLogA
ClearEventLogA
CloseEventLog
RegCreateKeyA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA

kernel32

GetStartupInfoA
GetSystemInfo
GetSystemDefaultLangID
CreateThread
MultiByteToWideChar
WinExec
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
GlobalMemoryStatus
GetVersionExA
GetTickCount
GetDriveTypeA
WaitForMultipleObjects
CloseHandle
GetDiskFreeSpaceExA
ExitThread
GetLastError
GetCurrentProcess
GetSystemDirectoryA
CreateProcessA
GetVolumeInformationA
CreatePipe
Sleep
ReadFile
PeekNamedPipe
WriteFile
DisconnectNamedPipe
TerminateProcess
TerminateThread

user32

ExitWindowsEx

gdi32

DeleteDC
GetDeviceCaps
CreateDCA

urlmon

URLDownloadToFileA

netapi32

NetApiBufferFree
NetUserEnum
NetUserDel

msvcrt

atoi
malloc
free
_local_unwind2
_except_handler3
sprintf
strstr
strncpy
printf
_strnicmp
_stricmp

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
12201931626/下载说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

968157287d0057b6db139d362b2e7fc1

Headers

File Characteristics

Imports

psapi

ws2_32

advapi32

kernel32

user32

gdi32

urlmon

netapi32

msvcrt

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 8KB - Virtual size: 9KB

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 8KB - Virtual size: 9KB