c021132f6cd46f67d39d8504811b3546 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c021132f6cd46f67d39d8504811b3546
Size

8KB
MD5

c021132f6cd46f67d39d8504811b3546
SHA1

1e1cabceb536787b9d5dee2ce6646c8ebf689d94
SHA256

b7c05b79d67f0a41df24e2178db4ed7a36809ab84f43afb9c18cf66e008f5140
SHA512

f342e024025d6d9a11f096fc5f7289a302f92b882d8affe4ab6784bcff91f8e2ae9990539cff050e60d36d75c3f7686dedec04bf8826a969a5e6562fa03a4df2
SSDEEP

96:Dwc08HPJXkMDTHx93BgTMehLoq9C26QB69uX8Ct6uXvMCuZ5yE6UKu8L7kBFsF4g:jPCSxXK5lYy6E8CeCuZ4Lu83kbYMgICz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c021132f6cd46f67d39d8504811b3546

Files

c021132f6cd46f67d39d8504811b3546
.exe windows:1 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 20B - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE