a47b728accbd85eff9de6e3f4af09a3d48054780cdb40c3a859e7abf0b7195ae

Sharing

Copy URL Twitter E-mail

General

Target

a47b728accbd85eff9de6e3f4af09a3d48054780cdb40c3a859e7abf0b7195ae
Size

127KB
MD5

fe98514b920bacef951f399d10b88252
SHA1

ef135c95a0064ca185f345ce7835952fdb8887fa
SHA256

a47b728accbd85eff9de6e3f4af09a3d48054780cdb40c3a859e7abf0b7195ae
SHA512

31e74cf3316a41960bdbaf8ff1189ac09abe4dbf672eb276ed9dedd6b995dc960273a3d74f0f6d58ae49176d3bd52277145aa8141a9c3b36e2f3ed9f34751097
SSDEEP

3072:Po0O2xnt+59S/FW7OlfERVJk2RQTNpA8tQd24k:PoJ2xJ1lfER3k2apA8Cd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a47b728accbd85eff9de6e3f4af09a3d48054780cdb40c3a859e7abf0b7195ae

Files

a47b728accbd85eff9de6e3f4af09a3d48054780cdb40c3a859e7abf0b7195ae
.exe windows:5 windows x86 arch:x86

d77f6210d4dd280fbd0043794cde4d69

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dev\wireshark-1.9\mergecap.pdb

Imports

wiretap-1.9.0

wtap_read
wtap_snapshot_length
wtap_open_offline
wtap_close
wtap_file_size
wtap_get_num_encap_types
wtap_get_num_file_types
wtap_dump_can_open
wtap_file_type_short_string
wtap_short_string_to_encap
wtap_short_string_to_file_type
wtap_strerror
wtap_file_type
wtap_file_type_string
wtap_file_encap
wtap_encap_short_string
wtap_encap_string
wtap_dump_fdopen_ng
wtap_dump_fdopen
wtap_phdr
wtap_buf_ptr
wtap_dump
wtap_dump_close

libwsutil

arg_list_utf_16to8
getopt
optarg
optopt
optind
ws_stdio_open

libglib-2.0-0

g_malloc
g_slist_insert_sorted
g_slist_foreach
g_slist_free
g_free
g_strerror
g_malloc_n
g_string_new
g_string_append_printf
g_string_free

msvcr100

_controlfp_s
_invoke_watson
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
strcmp
strtol
_errno
strncmp
exit
fprintf
__iob_func

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d77f6210d4dd280fbd0043794cde4d69

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wiretap-1.9.0

libwsutil

libglib-2.0-0

msvcr100

kernel32

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 111KB - Virtual size: 111KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 111KB - Virtual size: 111KB

.reloc
Size: 1KB - Virtual size: 1KB