a345f382ada6bb896b084d17b3a4ca6f

Sharing

Copy URL Twitter E-mail

General

Target

a345f382ada6bb896b084d17b3a4ca6f
Size

137KB
MD5

a345f382ada6bb896b084d17b3a4ca6f
SHA1

d4177a95f354564be58ae809e011a390fbb36ab0
SHA256

cf9d3cc9b4099b1fc6a0a7cc17b757c5a788f11965a741c2cee86b3a9a54f803
SHA512

bc7f0f20cfabbff2b2838385414693005879889b469e3ed792957e9b12be93b282e3888807d11779f47aaa7afdfcccb6a228055a2e70dd5f97ed099387001c71
SSDEEP

1536:gkZShQ7BWNxTLmCjwcqaz6/A3gA1xZNvlw/qhhiDsP6J2xS30BoPVoG:FSC7kzLmCscqZopZNvu/qj5y3hV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a345f382ada6bb896b084d17b3a4ca6f

Files

a345f382ada6bb896b084d17b3a4ca6f
.exe windows:6 windows x86 arch:x86

a90732fe981ccf905022fe3e10877e2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

nslookup.pdb

Imports

advapi32

RegCloseKey

kernel32

FormatMessageA
LocalFree
SetLastError
ExpandEnvironmentStringsA
LocalAlloc
GetLastError
WaitForSingleObject
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
HeapSetInformation
SetThreadUILanguage
ReleaseMutex

msvcrt

_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
perror
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__getmainargs
system
sprintf_s
putc
_write
fputs
fwrite
getc
ferror
fread
realloc
malloc
fputc
fflush
getenv
strcat_s
fopen
fgets
isspace
strncmp
_strnicmp
printf
putchar
strncpy_s
strchr
memset
fprintf
fclose
sscanf
free
strcpy_s
_iob
exit
_vsnprintf
gmtime
memcpy

wsock32

ord1108
htonl
gethostname
select
socket
connect
send
recv
closesocket
ntohs
inet_addr
getprotobynumber
htons
getservbyport
WSAStartup
WSAGetLastError

ws2_32

getaddrinfo
freeaddrinfo

user32

CharToOemBuffA

dnsapi

DnsQueryConfigAllocEx
DnsFreeConfigStructure

ntdll

RtlIpv4StringToAddressA
RtlIpv6AddressToStringA
RtlIpv6StringToAddressExA
RtlIpv6AddressToStringExA
RtlIpv4AddressToStringExA
RtlFreeUnicodeString
NtOpenKey
RtlAnsiStringToUnicodeString
RtlInitString
RtlUnicodeStringToAnsiString
NtQueryValueKey
RtlFreeHeap
RtlAllocateHeap

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 26KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

emcakxs
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a90732fe981ccf905022fe3e10877e2f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

wsock32

ws2_32

user32

dnsapi

ntdll

Sections

.text Size: 59KB - Virtual size: 58KB

.data Size: 26KB - Virtual size: 43KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 33KB - Virtual size: 34KB

emcakxs Size: - Virtual size: 4KB

.text
Size: 59KB - Virtual size: 58KB

.data
Size: 26KB - Virtual size: 43KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 33KB - Virtual size: 34KB

emcakxs
Size: - Virtual size: 4KB