c6e14cc04666cfc83a6003c171513dd6

Sharing

Copy URL Twitter E-mail

General

Target

c6e14cc04666cfc83a6003c171513dd6
Size

49KB
MD5

c6e14cc04666cfc83a6003c171513dd6
SHA1

5fcea2edbba226ea01c0b3c391150fa3711905ee
SHA256

c5d36a8c2ff01ef5acfcdd7a8ec33dd40ac250ee805b5d067ea3555720674864
SHA512

368381c755c41b2271cbe86f66d6ee17d75652f0dfd30590668ebfd8f88b7ff3bd5f374ad9a2adf7cc3ac803898de5b31bae825124a636bcd85d791ee34f6216
SSDEEP

768:+3218RfKHQZ5h/gbhkhAhAJmSegdg8LRgy9UKo9Lvi9soOB9KGCcHfMC:+8KJTub4AKfegdLRgMotviIBhCcHEC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6e14cc04666cfc83a6003c171513dd6

Files

c6e14cc04666cfc83a6003c171513dd6
.exe windows:5 windows x86 arch:x86

0ae47abf021515530d4a280c40d5db58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Users\Admin\Documents\Visual Studio 2010\Projects\Inject2\Release\Inject2.pdb

Imports

kernel32

GetThreadContext
SetThreadContext
GetCurrentProcess
Process32First
WaitForSingleObject
CreateRemoteThread
OpenProcess
Sleep
CreateProcessA
GetProcAddress
VirtualAllocEx
Process32Next
IsWow64Process
GetModuleHandleA
GetCurrentDirectoryA
CreateToolhelp32Snapshot
CloseHandle
WriteProcessMemory
ResumeThread
lstrcpyA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
EncodePointer
QueryPerformanceCounter
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange

user32

GetKeyState

winmm

timeGetTime

msvcr100

_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_initterm
_acmdln
exit
_ismbblead
_exit
_cexit
__getmainargs
_amsg_exit
sprintf_s
_stricmp
_XcptFilter
memset

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0ae47abf021515530d4a280c40d5db58

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

winmm

msvcr100

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 26KB - Virtual size: 29KB

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 26KB - Virtual size: 29KB