d72a90aa1cf5f2232ff09c75b9a74131 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d72a90aa1cf5f2232ff09c75b9a74131
Size

30KB
MD5

d72a90aa1cf5f2232ff09c75b9a74131
SHA1

476b26e0e3b7b83ab74aa6c2e00f0297d85e2c07
SHA256

599a6720e0da5baee1ce422f45bc549ead4fa24cb345a9197f3ee5342a5ad7a7
SHA512

0d85751bb035c5a4b2ad688514d0acf7ea8dd5869f1915f056315fb4ba47e0c5f264edb32c39dddc6827d882069a8f15ab018e36a93b2c98eb357e0d5dcfe4a5
SSDEEP

768:hTKrEADw5jgOGNrXHZ7UYjloH4jQj5DB/YvAET3GI:hupw5MOO5Y2loH40FJYvp2I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d72a90aa1cf5f2232ff09c75b9a74131

Files

d72a90aa1cf5f2232ff09c75b9a74131
.exe windows:4 windows x86 arch:x86

32a2dd8d05145e2cc8368eebcc2227ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

bind
listen
accept
shutdown
recv
WSAStartup
socket
gethostbyname
htons
connect
send
closesocket
WSACleanup

kernel32

lstrcpyA
CreateFileMappingA
GetLastError
GetStartupInfoA
GetModuleHandleA
ExitProcess
GetTickCount
GlobalAlloc
CreateThread
CreateProcessA
MoveFileExA
GetTempPathA
GetModuleFileNameA
Sleep
lstrlenA
lstrcatA
LoadLibraryA
GetProcAddress
GetVolumeInformationA
GetTempFileNameA

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strdup
_unlink
toupper
sprintf
atoi
fclose
ftell
fseek
fopen
_strcmpi
fread
strcpy
calloc
_except_handler3
malloc
fwrite
fputs
strlen
strcat
rand
strstr
strrchr
strcmp
memset
strtok
free
srand
__argv
__argc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm

Sections

.bss
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE