Net-Worm[.]Win32[.]Allaple[.]b-d98d6139b92958dc0060a5d167c50f5516049d7c5df018d1843a38f0fe2df6f8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Net-Worm.Win32.Allaple.b-d98d6139b92958dc0060a5d167c50f5516049d7c5df018d1843a38f0fe2df6f8
Size

119KB
MD5

7a69b196a999694e7d57951611aa2d0d
SHA1

871312fff0a447ae8cc3699025f5902293dee91c
SHA256

d98d6139b92958dc0060a5d167c50f5516049d7c5df018d1843a38f0fe2df6f8
SHA512

33a468905ccb1fec3c95f76708240a85a01ae684589207ba74ce5a0f5684f8cddd5273c3fd52f2e20865467332c2eb9c0ac6fc55b0e5d3c341e0ee254f31fd46
SSDEEP

1536:fbKnvB+lViWtX4tK+7ieE/0uN59e8rGDCFtPu/jE9maHN0eVLBqToWFYOT2yNv/P:jKnvsiQog+7CrZuovN0iBwAA2EUVNr6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Net-Worm.Win32.Allaple.b-d98d6139b92958dc0060a5d167c50f5516049d7c5df018d1843a38f0fe2df6f8

Files

Net-Worm.Win32.Allaple.b-d98d6139b92958dc0060a5d167c50f5516049d7c5df018d1843a38f0fe2df6f8
.exe windows:4 windows x86 arch:x86

4cdd411a6707f3d4f7a729788e5f2b10

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MapUserPhysicalPagesScatter
MoveFileExW
CancelThreadpoolIo
WritePrivateProfileSectionW
SignalObjectAndWait
WerRegisterAdditionalProcess
GetThreadLocale
UTUnRegister
TermsrvAppInstallMode
GetVolumePathNamesForVolumeNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE