c3d6e756d2e0825e4cda022861f1d3b1

General

Target

c3d6e756d2e0825e4cda022861f1d3b1
Size

21KB
MD5

c3d6e756d2e0825e4cda022861f1d3b1
SHA1

479b99c8793e06cbf8dd0988568cfdf015247efd
SHA256

03a24e0dc651d04de68fb7274c2700e4073367c5778b64564e4d977fc08e1e4f
SHA512

4ecc650338c61afd776955f2fff0693a18d19fee6ead4aab18e74a5fc34425c66c46d0aca3b62e64f9f4b8efc5956b1afb7cdfc73d3fe58043b3224b425dc1bf
SSDEEP

384:r7P3jjLnWeDHZ7RPWXxecHuwHxmC/Dm6X7E+98EvO0KauJOIYBLWvUg:/jWyHZ7ROhecRHxmCa+X8KTKauIR16

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3d6e756d2e0825e4cda022861f1d3b1

Files

c3d6e756d2e0825e4cda022861f1d3b1
.exe windows:4 windows x86 arch:x86

76fadb6a723e1a5bd5b9f41d0c214442

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

gethostname
socket
htons
gethostbyaddr
gethostbyname
connect
ioctlsocket
recv
WSAStartup
send
closesocket

kernel32

GetModuleHandleA
CloseHandle
GetStartupInfoA
DeleteFileA
GetLocalTime
ExitProcess
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
GetTimeZoneInformation
CreateThread
GetWindowsDirectoryA
CreateProcessA
GetSystemDirectoryA
GetModuleFileNameA
GetCommandLineA
CopyFileA
TerminateProcess
OpenProcess
GetCurrentProcessId
GetComputerNameA
InitializeCriticalSection
LoadResource
FindResourceA

user32

GetWindowTextA
GetForegroundWindow
SetTimer
GetMessageA
CharUpperBuffA

advapi32

RegSetValueExA
RegQueryValueExA
GetUserNameA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

msvcrt

_controlfp
fopen
strcat
fread
_initterm
fseek
__p__acmdln
exit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
sprintf
strlen
??2@YAPAXI@Z
memcpy
ftell
fwrite
memset
fclose
strncmp
__getmainargs
__setusermatherr
sscanf
??3@YAXPAX@Z
abs
strcpy
strstr
strcmp
strrchr
strncpy
_exit
_XcptFilter

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76fadb6a723e1a5bd5b9f41d0c214442

Headers

File Characteristics

Imports

wsock32

kernel32

user32

advapi32

msvcrt

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 512B - Virtual size: 16B

.data Size: 1KB - Virtual size: 4KB

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 512B - Virtual size: 16B

.data
Size: 1KB - Virtual size: 4KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 2KB