a1b[.]exe[.]malware | Triage

Sharing

General

Target

a1b.exe.malware
Size

27KB
MD5

4fba3f91abb55e0aff6abbb57534b02c
SHA1

4ab86899196c9ae902cf01e98899e8a028b7945c
SHA256

1aeb85a0997f1c0eb987bf233a057bed958169d1a348bbce1492c269f78a1960
SHA512

711ef9e396cf47d90fbf3903532661f1bfa52d77315f339c8677c0ffb81059f781633ee90d149ef7d615dbd0815131df0a926ea215f10be67b6e95845665bc67
SSDEEP

384:y3qllzH/Biozn+I7/y6POezs8SYNJGR9w1EN:yallH/Bioj+Ifzzsy4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1b.exe.malware

Files

a1b.exe.malware
.exe windows:4 windows x86 arch:x86

e6d4d4d27f28e2d0f3d44f1a8257201c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
AllocConsole
ExitProcess
FindAtomA
GetAtomNameA
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
ctime
exit
fclose
fflush
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
malloc
memcpy
memset
perror
signal
strcat
strcpy
strlen
strncat
time

user32

FindWindowA
GetAsyncKeyState
ShowWindow

ws2_32

WSACleanup
WSAStartup
closesocket
connect
gethostbyname
htons
recv
send
socket

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE