systembc | 0x0006000000015679-49[.]dat

Sharing

Copy URL

Twitter E-mail

General

Target

0x0006000000015679-49.dat
Size

16KB
MD5

4f01c3d7439dde153ff0110a26e2a71c
SHA1

40d7203ad4e1fd40e13a56e6f747ee480740873c
SHA256

cfb1fd0adf528fcf14647cf3fcd85fb7e4fddd2167b36f9e8b2424b62453df28
SHA512

513d09b80e1ac80813bc691e71cdf5348478157350e43b9daed27741b7f5a7a16b2ae4d88ee9951395747c7f2a93ff0c1f2c3753a9e3bad2e2607767a1e3d28e
SSDEEP

384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V

Score

10^/10

systembc

Malware Config

Signatures

Systembc family
systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0006000000015679-49.dat

Files

0x0006000000015679-49.dat
.exe windows:4 windows x86 arch:x86

b83b4c7be0b1cdd8e117bba9096d9768

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetMessageA
GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
CreateWindowExA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
wsprintfA

kernel32

ResetEvent
SetEvent
SetFilePointer
OpenProcess
RemoveDirectoryA
LocalAlloc
WriteFile
WaitForSingleObject
VirtualFree
VirtualAlloc
SystemTimeToFileTime
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalFree
Sleep

advapi32

GetSidSubAuthority
GetUserNameW
OpenProcessToken
GetTokenInformation

wsock32

htons
inet_addr
inet_ntoa
recv
select
send
setsockopt
shutdown
socket
connect
closesocket
ioctlsocket
WSAStartup
WSACleanup

shell32

CommandLineToArgvW

ws2_32

freeaddrinfo
WSAIoctl
getaddrinfo

ole32

CoUninitialize
CoInitialize
CoCreateInstance

secur32

GetUserNameExW
QueryContextAttributesA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
InitializeSecurityContextA

psapi

GetModuleFileNameExA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b83b4c7be0b1cdd8e117bba9096d9768

Headers

File Characteristics

Imports

user32

kernel32

advapi32

wsock32

shell32

ws2_32

ole32

secur32

psapi

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 812B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 812B