ipconfig[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ipconfig.exe
Size

28KB
MD5

efad0aeb4859b90a8fd25d30f7cb253b
SHA1

8ad80c59ee4d9459c112446762320da7ae2d24f0
SHA256

1803f2b06149d09d568a0d83cab8017925aded03047791dc92d8254de7b2262a
SHA512

69ff654be934bdb24b8cd9859843dd6da2e82892220226c203ac969fb5605b7f847e4815854a8e3ee628300e0f265357280d6719d84535140261dc2c50647e9e
SSDEEP

384:kSTbXHl9D4Yi9ntDqFHj+4Dj/UVWsP4sqLl9vjxsvXgmfqB/uNpyDi4b90RWJGWz:kMTi9dqtNjsVWsPGlRqvjyDb9X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ipconfig.exe

Files

ipconfig.exe
.exe windows:10 windows x86 arch:x86

8659ffcb871b486c6a3880c874a9b0b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ipconfig.pdb

Imports

msvcrt

wcschr
_wcsicmp
_get_osfhandle
fflush
_setmode
_write
_fileno
fgetpos
fwprintf
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
__set_app_type
__wgetmainargs
__iob_func
_amsg_exit
__p__commode
?terminate@@YAXXZ
_controlfp
toupper
_except_handler4_common
_XcptFilter
exit
setlocale
memcpy
_vsnwprintf
memset

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
LoadLibraryExW
GetProcAddress

iphlpapi

ConvertInterfaceIndexToLuid
ConvertGuidToStringW
ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToGuid
GetNetworkParams
GetAdaptersAddresses
GetCurrentThreadCompartmentId
SetCurrentThreadCompartmentId
ConvertLengthToIpv4Mask

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

ntdll

RtlIpv6AddressToStringW
RtlStringFromGUID
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFreeUnicodeString

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
FormatMessageW

ws2_32

InetNtopW

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
GetFileType

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

dnsapi

DnsFlushResolverCache
DnsFreeConfigStructure
DnsResolverOp
DnsQuery_W
DnsFree
DnsQueryConfigAllocEx
DnsGetCacheDataTableEx

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSetInformation
GetProcessHeap
HeapAlloc

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-console-l1-1-0

GetConsoleMode

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

nsi

NsiFreeTable
NsiGetAllParameters
NsiSetAllParameters
NsiAllocateAndGetTable

dhcpcsvc

DhcpReleaseParameters
DhcpHandlePnPEvent
DhcpEnumClasses
DhcpAcquireParameters

dhcpcsvc6

Dhcpv6GetUserClasses
Dhcpv6ReleaseParameters
Dhcpv6AcquireParameters
Dhcpv6SetUserClass
Dhcpv6IsEnabled

api-ms-win-security-base-l1-1-0

CheckTokenMembership
FreeSid
AllocateAndInitializeSid

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8659ffcb871b486c6a3880c874a9b0b2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

iphlpapi

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

ntdll

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

ws2_32

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

dnsapi

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

nsi

dhcpcsvc

dhcpcsvc6

api-ms-win-security-base-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 916B

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 916B

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB