d59805b1ca80e4d179fcc096f4192664

General

Target

d59805b1ca80e4d179fcc096f4192664
Size

127KB
MD5

d59805b1ca80e4d179fcc096f4192664
SHA1

6e3968c12cbb74d55822ea8945557e3b26b50e57
SHA256

2f61864e5875d9625b60dedf647eb07d92d08c5612ce22b4c3254ee643980061
SHA512

5f20ae2cb8b5670137ad59dfba0f14cdb09ebbc479ab8cde7b5c0cf2b1eb6d518e2d9079e7178d2aae02f1d8a640409f0f4fc85dca759bf33d106a7c2dc2927e
SSDEEP

768:g0x6EWdQV9kb7/zIw4NBSkPxnUVyYdxgU941yEaB0BJiUIMiWrGQzTGfmgc33emW:1x6u9sbz2+kP5Y1gdy/BwIdvQVgd54vs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d59805b1ca80e4d179fcc096f4192664

Files

d59805b1ca80e4d179fcc096f4192664
.exe windows:5 windows x86 arch:x86

c1dded81f3950cebede98d595ae80b7e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\work\VC08\hackMaker\wormMore\Release\wormMore.pdb

Imports

kernel32

GetLogicalDriveStringsA
CreateProcessA
WaitForSingleObject
Sleep
FindFirstFileA
FindNextFileA
FindClose
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime

msvcr90

getchar
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
srand
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_chdir
_getcwd
rand
printf
fclose
fputc
fprintf
fopen
sprintf
strchr
_time64
_initterm_e
_strupr
memset

shlwapi

PathIsDirectoryA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c1dded81f3950cebede98d595ae80b7e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcr90

shlwapi

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 40KB - Virtual size: 42KB

.rsrc Size: 78KB - Virtual size: 80KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 40KB - Virtual size: 42KB

.rsrc
Size: 78KB - Virtual size: 80KB