bad475c0fdec35dbec1e8192e4b1f840

Sharing

Copy URL Twitter E-mail

General

Target

bad475c0fdec35dbec1e8192e4b1f840
Size

60KB
MD5

bad475c0fdec35dbec1e8192e4b1f840
SHA1

86d8780a1ebd0eefda4271b621b333c4ef7d7034
SHA256

fbee9195246ffee7ec0377cb7855aa51adb0f0fe3ac6c1137d1640d79b021138
SHA512

127410d920085e9fea20b6b5dad7abc29e1ef9f67f137c67b2594311d9a468b17b716bc7e05d1a88c1abfc2a26e685ab79c518fac2bb9c2a1453466c1d905297
SSDEEP

768:Qqn+DdNknS0WyUmLCETCCbpnHhREu799XtQjtyHp:k7knSEUHAC4H3PtctyHp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bad475c0fdec35dbec1e8192e4b1f840

Files

bad475c0fdec35dbec1e8192e4b1f840
.exe windows:4 windows x86 arch:x86

fb3518abe2e2019f3af4d9acb91dda91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CreateThread
WinExec
GetProcAddress
LoadLibraryA
GetTempPathA
EndUpdateResourceA
lstrlenA
UpdateResourceA
BeginUpdateResourceA
GlobalFree
ReadFile
GlobalAlloc
CloseHandle
GetFileSize
CreateFileA
GetFileAttributesA
lstrcatA
lstrcpyA
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceA
EnumResourceNamesA
WaitForSingleObject
ExitProcess
GetLastError
CreateMutexA
GetTickCount
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
GetModuleHandleW
GetModuleFileNameW
GetThreadContext
CreateProcessW
OpenProcess
GetCurrentProcessId
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
GlobalMemoryStatusEx
GetComputerNameA
GetLocaleInfoW
SetStdHandle
LCMapStringW
LCMapStringA
SetFilePointer
GetOEMCP
GetACP
FlushFileBuffers
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
HeapReAlloc
VirtualAlloc
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
ExitThread
TerminateProcess
CreateProcessA
GetCurrentProcess
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree

shell32

ShellExecuteA

ws2_32

send
select
__WSAFDIsSet
recv
WSAStartup
htons
socket
connect
closesocket
setsockopt
WSAIoctl
gethostbyname
inet_addr
sendto
WSASocketA
htonl

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb3518abe2e2019f3af4d9acb91dda91

Headers

File Characteristics

Imports

kernel32

shell32

ws2_32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 920B

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 920B