massdns[.]exe[.]3

Sharing

Copy URL Twitter E-mail

General

Target

massdns.exe.3
Size

257KB
MD5

7083b40ef49806e2c07461bd2cd6ae6f
SHA1

dc2c20a8be804c7adfe354254106625f7b28cc0f
SHA256

fe50bf80dab884e2b924ca2b85d4cf7bad9cb6c6228f494e2cd87a2d3b42481e
SHA512

957c05687d1ca0726bc986d1af49cb3023458d1c2cb2d68cd6cafc03c6ba27427a689b7be89ff8466ef2f6596acf60e6baebce66219dede89e7262bc4d8a4092
SSDEEP

6144:2KNxIWOh+EbiOx5WL/e3+4CbX2MCTjCNEq5JefFr8YD7JuT+JfxO7Sv6o:2KNxW2O2aGGTjv9PDtnO7Sv6o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
massdns.exe.3

Files

massdns.exe.3
.exe windows:4 windows x86 arch:x86

f38084a9e0935ae023801b969f9f6dfa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Imports

cygwin1

__assert_func
__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__main
__stack_chk_fail
__stack_chk_guard
_dll_crt0@0
_fcntl64
_fopen64
_geteuid32
_getgrnam32
_impure_ptr
_setgid32
_setuid32
abort
atoi
bind
bzero
calloc
clock_gettime
close
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
exit
fclose
fcntl
fflush
fgets
fopen
fork
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
geteuid
getgrnam
getpid
getpwnam
inet_ntop
inet_pton
isatty
kill
malloc
memcmp
memcpy
perror
pipe
posix_memalign
read
realloc
recvfrom
sendto
setgid
setsockopt
setuid
signal
snprintf
socket
sprintf
strcasecmp
strchr
strcmp
strerror
strlen
strtoul
strtoull
time
tolower
vfprintf
write

cyggcc_s-1

__divdi3
__moddi3

kernel32

FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/14
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 1024B - Virtual size: 938B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 512B - Virtual size: 357B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f38084a9e0935ae023801b969f9f6dfa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cygwin1

cyggcc_s-1

kernel32

Sections

.text Size: 60KB - Virtual size: 60KB

.data Size: 512B - Virtual size: 64B

.rdata Size: 11KB - Virtual size: 10KB

.buildid Size: 512B - Virtual size: 53B

/4 Size: 8KB - Virtual size: 8KB

.bss Size: - Virtual size: 2.5MB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

/14 Size: 512B - Virtual size: 408B

/29 Size: 119KB - Virtual size: 118KB

/41 Size: 6KB - Virtual size: 5KB

/55 Size: 7KB - Virtual size: 7KB

/67 Size: 512B - Virtual size: 56B

/80 Size: 1024B - Virtual size: 938B

/91 Size: 512B - Virtual size: 357B

.text
Size: 60KB - Virtual size: 60KB

.data
Size: 512B - Virtual size: 64B

.rdata
Size: 11KB - Virtual size: 10KB

.buildid
Size: 512B - Virtual size: 53B

/4
Size: 8KB - Virtual size: 8KB

.bss
Size: - Virtual size: 2.5MB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

/14
Size: 512B - Virtual size: 408B

/29
Size: 119KB - Virtual size: 118KB

/41
Size: 6KB - Virtual size: 5KB

/55
Size: 7KB - Virtual size: 7KB

/67
Size: 512B - Virtual size: 56B

/80
Size: 1024B - Virtual size: 938B

/91
Size: 512B - Virtual size: 357B