a9ca7289fd4e8990f5aee69c7708e9cd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a9ca7289fd4e8990f5aee69c7708e9cd
Size

27KB
MD5

a9ca7289fd4e8990f5aee69c7708e9cd
SHA1

a174b0bf7245539d5ab8ea3262c31cab3bc29680
SHA256

6cb0f77eb68256987a2067c944ac7a6e00612583a9eae4b652177c62cd4bf53a
SHA512

faa7934f52e95fd8575cdc6625527b09e633a177476412bcc68d12cb8140ae33df4e76a3a361ebc5ae6da0829f4819a0368404ba7eb4925e76fd29997954529a
SSDEEP

384:yTJ3wCA7XG8uT35zr4g6p1oEPw6cI1OAkJkax6bC87nD0kth3s/cBv/Ikl:yTKfXG8O35zr6pTYSORmPbv37jQUv/IM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9ca7289fd4e8990f5aee69c7708e9cd

Files

a9ca7289fd4e8990f5aee69c7708e9cd
.exe windows:4 windows x86 arch:x86

7aba07606ff498bd9977905a960b754e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
socket
gethostbyname
htons
connect
send
closesocket
WSACleanup

kernel32

GetVolumeInformationA
SetErrorMode
CreateFileMappingA
GetStartupInfoA
GetModuleHandleA
GetLastError
CreateThread
ExitProcess
GetTickCount
lstrlenA
lstrcatA
lstrcpyA
LoadLibraryA
GetProcAddress
GetTempFileNameA
Sleep
GetModuleFileNameA
GetTempPathA
MoveFileExA
CreateProcessA

msvcrt

_controlfp
_strdup
_unlink
strcpy
sprintf
atoi
fclose
ftell
fseek
fopen
toupper
fread
_strcmpi
calloc
_except_handler3
malloc
fwrite
fputs
strlen
strcat
rand
strstr
strrchr
strcmp
memset
strtok
srand
__argv
__argc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

Sections

.bss
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ