a38bf01d2d4430836e7db83da9116ff4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a38bf01d2d4430836e7db83da9116ff4
Size

72KB
MD5

a38bf01d2d4430836e7db83da9116ff4
SHA1

1a4b1444e606add684087721506d963db5af05a2
SHA256

52ae34ea9c7afbf05c8dc2b15161b9b1c320d38529fd6c66dd25b5edfd5f3097
SHA512

7394a2b3f4bc1bce3a051465eacf44323282aa6df2528c94a1d1da6ae3eb8aab62231d34aa7be8148dbd6b503d035b7b6950042fef89c59fad79762f79f20932
SSDEEP

1536:VOVgMEGwtx5eXCg2keDdYxtSdYwyuI5GSnVhwl0bgBxc1:VqgBhe3PRLeY75GSVSl0bgBxk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a38bf01d2d4430836e7db83da9116ff4

Files

a38bf01d2d4430836e7db83da9116ff4
.exe windows:5 windows x86 arch:x86

847ff2c9a3beeb55078242189a2bbe39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
fopen
putc
fclose
_unlink
_write
_close
_initterm
_fdopen
free
malloc
isprint
fputs
_itoa
atoi
_ftol
_CIpow
calloc
sprintf
_getpid
_open
_errno
atol
_strnicmp
__getmainargs
__initenv
_cexit
_XcptFilter
_exit
_c_exit
fprintf
time
exit
getc
_read
_stat
_iob
_dup
__setusermatherr
_stricmp
_access

kernel32

MoveFileA
DeleteFileA
LocalFree
IsDBCSLeadByteEx
GetLocalTime
GetModuleHandleA
GetLastError
FormatMessageA

ws2_32

socket
bind
getsockname
closesocket
recvfrom
getaddrinfo
freeaddrinfo
getnameinfo
htons
ntohs
select
getservbyname
WSAStartup
sendto

user32

CharNextExA
CharToOemBuffA

mswsock

s_perror

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ