3585a5cbbf1b8b3206d7280355194d5442ed997f61e061fd6938a93163c79507

Sharing

Copy URL Twitter E-mail

General

Target

3585a5cbbf1b8b3206d7280355194d5442ed997f61e061fd6938a93163c79507
Size

79KB
MD5

17610eb039d361ec09f1b741d97c093c
SHA1

f99b562740dcb78c8f22947873613ad9af9aa8d9
SHA256

3585a5cbbf1b8b3206d7280355194d5442ed997f61e061fd6938a93163c79507
SHA512

a6c87254073ea8b775f5176f9f08ca3d0d84ac05e51735996e887d4e8feccd913bceca781824a31ab79761d53b8eff9533a1a918a1e74eb128f9a6459dc75fe8
SSDEEP

1536:/1OvbyPWGM9qOax8aNGjxAQ8lBncBxsWjcdsy0Aq:/WipM9qhTdbBe+syU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3585a5cbbf1b8b3206d7280355194d5442ed997f61e061fd6938a93163c79507

Files

3585a5cbbf1b8b3206d7280355194d5442ed997f61e061fd6938a93163c79507
.exe windows:5 windows x86 arch:x86

6ba6436f3db1acdbc9e57edd6fabbc3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\D\Desktop\port_scan\PortScan\Release\PortScan.pdb

Imports

wsock32

inet_ntoa
connect
inet_addr
WSAStartup
ioctlsocket
htonl
select
WSAGetLastError
htons
ntohs
shutdown
WSACleanup
recv
socket
__WSAFDIsSet
closesocket
send

kernel32

TerminateProcess
CreateFileW
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
LCMapStringW
HeapReAlloc
Sleep
GetLastError
CloseHandle
CreateThread
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetLocalTime
GetCommandLineA
GetProcessHeap
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetCurrentThreadId
GetFileType
DeleteCriticalSection
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
RtlUnwind
HeapSize

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ba6436f3db1acdbc9e57edd6fabbc3e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

kernel32

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 3KB - Virtual size: 3KB