c2171575c5e1d75144f957ca79a06a94

Sharing

Copy URL Twitter E-mail

General

Target

c2171575c5e1d75144f957ca79a06a94
Size

57KB
MD5

c2171575c5e1d75144f957ca79a06a94
SHA1

e74c09d402db23b8e8dcc7e624b31b8fbe1c979c
SHA256

eb0acfe1f4d2ece2b39d2b139e08dddeee6bad82b63d1e28dc12bde3b860eaec
SHA512

5f9f6f50544203be3e0d1109c28cec31fa9b7645edbe3c1f01a5f7d0a1d922f032771fb16e4fa22a03f752ff1c500138bd27f47cb97d26cdd2374de4ed6dd1db
SSDEEP

768:zQyj6dglOmfckCrA+dOq/HLrXNNE+PJl5hv+eluXbwVMWe0AbSz7SlGFPdO0DY7a:zQyj6dBmkkiz3gekU/OlGFP00M7OkYx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2171575c5e1d75144f957ca79a06a94

Files

c2171575c5e1d75144f957ca79a06a94
.exe windows:4 windows x86 arch:x86

4f495fc076df969290385c8c6b188f31

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetTimeFormatA
GetLocalTime
ExpandEnvironmentStringsA
CloseHandle
WriteFile
CreateFileA
CreateThread
DeleteFileA
GetTempPathA
GetVersionExA
GlobalMemoryStatus
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
CreateMutexA
GetLastError
Sleep
GetSystemDirectoryA
CopyFileA
TerminateThread
CreateProcessA
GetStringTypeA
FlushFileBuffers
SetStdHandle
SetFilePointer
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
SetEndOfFile
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
ReadFile
GetVersion
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
GetCurrentProcess
TerminateProcess
ExitProcess

user32

FindWindowA
SendMessageA

mpr

WNetAddConnection2A
WNetCancelConnection2A

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA

shell32

ShellExecuteA

ws2_32

inet_ntoa
gethostbyaddr
recv
socket
connect
getsockname
WSASocketA
htons
htonl
sendto
WSAGetLastError
inet_addr
gethostbyname
WSAStartup
WSACleanup
closesocket
select
ioctlsocket
accept
listen
bind
WSAAsyncSelect
send
setsockopt

wininet

InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA

Sections

.text
Size: 34KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.WWP32
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4f495fc076df969290385c8c6b188f31

Headers

File Characteristics

Imports

kernel32

user32

mpr

advapi32

shell32

ws2_32

wininet

Sections

.text Size: 34KB - Virtual size: 54KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 163KB

.WWP32 Size: 1024B - Virtual size: 712B

.text
Size: 34KB - Virtual size: 54KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 163KB

.WWP32
Size: 1024B - Virtual size: 712B