de0dacdd303fa3fe128ce6b4df43f764 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de0dacdd303fa3fe128ce6b4df43f764
Size

6KB
MD5

de0dacdd303fa3fe128ce6b4df43f764
SHA1

8ff3787f8c50f2f2baf07f2edef36a07e5855536
SHA256

e63785321321a0c56f07fa906154ecb40636c097b5a6b66b54cdc25edd39459a
SHA512

be68c607252728d5f1aaaf321c4ea8a3cef80823d8e589a7ee3f59f4c443e161a6cc99756998352ec208737a7f84df17f05b0c0e064fad3fb7c359a40e92af98
SSDEEP

192:wC9a8auz44wijMH4YHM2yBWlbm48AqmUoy:jCuS5BuAxfqD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de0dacdd303fa3fe128ce6b4df43f764

Files

de0dacdd303fa3fe128ce6b4df43f764
.exe windows:4 windows x86 arch:x86

137ba214d65994bb638f45eeaf0633f2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
CloseHandle
WaitForSingleObject
CreateThread
Sleep
GetCurrentThreadId
WriteFile
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
TerminateProcess
GetModuleHandleA

user32

GetMessageA
GetInputState
PostThreadMessageA

msvcrt

__p__fmode
_except_handler3
memset
realloc
malloc
strlen
exit
printf
strcpy
_exit
_controlfp
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_XcptFilter
__set_app_type

ws2_32

WSAStartup
connect
WSAIoctl
setsockopt
WSACleanup
WSASocketA
closesocket
shutdown
gethostbyname
send
recv
htons

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE