c60df4987e23dc4b4d95ad2f39ba56e2

Sharing

Copy URL

Twitter E-mail

General

Target

c60df4987e23dc4b4d95ad2f39ba56e2
Size

448KB
MD5

c60df4987e23dc4b4d95ad2f39ba56e2
SHA1

6fe684ab5ced6f730d905196257c334f2871ebe7
SHA256

dcb3b492cdbf0a0ed76f9d41c0c25a9050d255687b6030e4ab50d0651e34a0d1
SHA512

8c9b673cf8e4e12317385f8e378ac5a5e9546eef4c5e3c0681372b4a74d48fac3f916b0b0eef0fc58f7dcea9d6d3d00e62167e93b29d011465aa5cd9cf6d5ce2
SSDEEP

6144:a3bAuBQgmtgAe+XnFPXw9yL6kQWvZRF6Ig1CsfcQOz0mfx7qnrB:W/VmtgAe+XBouFQWrF6IgE5LZE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c60df4987e23dc4b4d95ad2f39ba56e2

Files

c60df4987e23dc4b4d95ad2f39ba56e2
.exe windows:4 windows x86 arch:x86

b664c21663d293010f4aceb688b9d980

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\Moje dokumenty\Visual Studio 2005\Projects\d\debug\downloader.pdb

Imports

ws2_32

recv
__WSAFDIsSet
select
WSACleanup
inet_addr
gethostbyname
getsockname
WSAStartup
htons
WSAAsyncSelect
bind
setsockopt
listen
accept
closesocket
socket
WSAGetLastError
connect
send

kernel32

CreateFileA
GetTimeZoneInformation
lstrlenA
RaiseException
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
GetStdHandle
VirtualQuery
FreeLibrary
GetProcAddress
LoadLibraryA
ExitThread
CreateThread
Sleep
ExitProcess
CloseHandle
CreateProcessA
OpenProcess
GetCurrentProcessId
CopyFileA
SetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
WaitForSingleObject
CreateMutexA
CompareStringA
CompareStringW
AllocConsole
HeapValidate
LCMapStringW
LCMapStringA
SetFilePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
InterlockedExchange
GetSystemTimeAsFileTime
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
GetLastError
GetFileType
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
DeleteCriticalSection
FatalAppExitA
SetEnvironmentVariableA
IsBadReadPtr
DebugBreak
InterlockedDecrement
WriteFile
OutputDebugStringA
InterlockedIncrement
WriteConsoleW
OutputDebugStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
LoadLibraryW
SetHandleCount
SetLastError
InitializeCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
GetCurrentThread
GetACP
GetOEMCP
GetCPInfo
QueryPerformanceCounter
GetTickCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
VirtualAlloc
MultiByteToWideChar
RtlUnwind

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyExA

ole32

CoInitializeEx
CoCreateInstance

oleaut32

SysStringLen
SysAllocString
SysFreeString

Sections

.text
Size: 356KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b664c21663d293010f4aceb688b9d980

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 356KB - Virtual size: 353KB

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 8KB - Virtual size: 13KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 356KB - Virtual size: 353KB

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 8KB - Virtual size: 13KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 3KB