b4651b4ace9aa078770efda903a6c39e

General

Target

b4651b4ace9aa078770efda903a6c39e
Size

40KB
MD5

b4651b4ace9aa078770efda903a6c39e
SHA1

68630a37a0e1a13dd9b1a9fa974b0be89bc341ef
SHA256

67e3fbb19376b27941651728195d37ec3abc722c4f69ae23c00a7d39632f5d4b
SHA512

a7cc5b503058f1fc1ba970e585f7997918e36c8ac9a769d4db04c979153a18a18adbb5cfd70afd0db00f5d265873a4e61a345b367dc9238e8e9a7bcce4d40e02
SSDEEP

384:CfPtVFqK/xpHkyYkbhAlV5+RdBxF38X4xKyRcb8fqXl6E3cPS8BDClH1YvzlO:C1V9YyviV8p8IqEqV6EMa8BDWYrl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4651b4ace9aa078770efda903a6c39e

Files

b4651b4ace9aa078770efda903a6c39e
.exe windows:4 windows x86 arch:x86

08844b63f5f0ffc4d0d5ef19f392d70e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\桌面\dev\SmartDoor\Release\SmartDoor.pdb

Imports

kernel32

GetSystemDirectoryA
CreatePipe
Sleep
CloseHandle
WaitForSingleObject
CreateProcessA
lstrlenA
CopyFileA
GetModuleFileNameA
LocalFree
GetCommandLineW
PeekNamedPipe
ReadFile
CreateThread
WriteFile
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetLocaleInfoA
GetSystemInfo
VirtualProtect
SetFilePointer
FlushFileBuffers
VirtualAlloc
GetCPInfo
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapReAlloc
HeapAlloc
HeapSize
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
SetStdHandle

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA

shell32

CommandLineToArgvW

ws2_32

socket
htonl
htons
bind
WSAGetLastError
accept
setsockopt
send
recv
closesocket
WSAStartup
listen

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

08844b63f5f0ffc4d0d5ef19f392d70e

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ws2_32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 7KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 7KB