de383ddf95ac5cf24fc4ce7685ac8c6b

General

Target

de383ddf95ac5cf24fc4ce7685ac8c6b
Size

48KB
MD5

de383ddf95ac5cf24fc4ce7685ac8c6b
SHA1

63a898174cf89ce5d3529fea32ba613e253a2680
SHA256

86279621f3f22b05c55fd8c66ca281129fbda6bc893679e78a159c6c8a10beb4
SHA512

2055d719a8717bf949e18c50ccd7afbf28788257d2c1230b025a894087554c7d430d851ef4ade2675f5b7fdcab8150d45404bb59af3cd2b9315ac6c1741ce4f2
SSDEEP

768:mRPyXHuttc8Yrsh8LhrLZugIvmSHrHglg5:m8HAtc8YDLhrLivmSHcl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de383ddf95ac5cf24fc4ce7685ac8c6b

Files

de383ddf95ac5cf24fc4ce7685ac8c6b
.exe windows:4 windows x86 arch:x86

feaa59a4c8b2c30ab928459480196043

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

recv
send
closesocket
connect
htons
getservbyname
socket
gethostbyaddr
gethostbyname
ioctlsocket
WSACleanup
WSAStartup

kernel32

GetEnvironmentStringsW
SetEndOfFile
HeapSize
LCMapStringW
LCMapStringA
GetLocaleInfoA
InterlockedExchange
RtlUnwind
LoadLibraryA
GetStringTypeW
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
Sleep
GetVolumeInformationA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
GetLastError
WriteFile
HeapFree
CloseHandle
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
ReadFile
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
SetFilePointer
HeapAlloc
CompareStringA
MultiByteToWideChar
GetCPInfo
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
CreateFileA
FlushFileBuffers
VirtualAlloc
HeapReAlloc
SetStdHandle
QueryPerformanceCounter

shell32

ShellExecuteA

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

feaa59a4c8b2c30ab928459480196043

Headers

File Characteristics

Imports

wsock32

kernel32

shell32

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 8KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 8KB