eb125f76b0c347ce285a64d0217068197211bece2cf7937f2b3332cd78fb66ec

Sharing

Copy URL Twitter E-mail

General

Target

eb125f76b0c347ce285a64d0217068197211bece2cf7937f2b3332cd78fb66ec
Size

1.3MB
MD5

72f63fae14c82491ae1e06a26750ba05
SHA1

d79ddcb0a5baf8c05faaa8bf435159a0fc301aff
SHA256

eb125f76b0c347ce285a64d0217068197211bece2cf7937f2b3332cd78fb66ec
SHA512

0db4b3f8bb0040609f74e92ff31fc28177c4e0fa99db6b4b9f8794de1c6b2fa061d5331f00085c170757e13245dfc5059ae0a4c6592a1d30132b815cdf157716
SSDEEP

24576:ix//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ixLNiXicJFFRGNzj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb125f76b0c347ce285a64d0217068197211bece2cf7937f2b3332cd78fb66ec

Files

eb125f76b0c347ce285a64d0217068197211bece2cf7937f2b3332cd78fb66ec
.exe windows:6 windows x86 arch:x86

10160c4206d23c504cd2301e332cef11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

aspnet_state.pdb

Imports

mswsock

GetAcceptExSockaddrs
AcceptEx

ole32

CoInitializeEx
CoUninitialize

ws2_32

ntohs
select
WSACleanup
WSAGetOverlappedResult
WSASocketW
WSAGetLastError
setsockopt
WSARecv
WSASend
WSAAddressToStringA
bind
recv
htonl
WSAStartup
closesocket
htons
inet_ntoa
listen

mscoree

ClrCreateManagedInstance

webengine4

GetXSPHeap
LoadLibraryUsingFullPath
AttachHandleToThreadPool
XspLogEvent
InitializeLibrary
PrintResourceString
PerfCounterInitialize
AspnetLoadResourceDLL

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW

kernel32

GetProcessAffinityMask
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetVersionExW
QueryPerformanceCounter
HeapReAlloc
WideCharToMultiByte
FileTimeToSystemTime
lstrlenW
GetSystemTimeAsFileTime
InterlockedDecrement
InterlockedIncrement
FileTimeToLocalFileTime
LoadLibraryW
SwitchToThread
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
GetSystemDirectoryW
MultiByteToWideChar
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
FreeLibrary
GetProcAddress
SetEvent
WaitForSingleObject
GetSystemInfo
CloseHandle
CreateEventW
SetWaitableTimer
Sleep
CreateThread
FormatMessageW
CreateWaitableTimerW
SetConsoleCtrlHandler
GetLastError
InterlockedExchange
InterlockedCompareExchange

vcruntime140_clr0400

_except_handler4_common
_purecall
memset
memcpy
strstr
strchr

ucrtbase_clr0400

_seh_filter_exe
_set_app_type
__setusermatherr
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___wargv
_cexit
_c_exit
wcscpy_s
_configthreadlocale
_set_new_mode
__p__commode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
strncmp
__stdio_common_vswprintf
strtol
_itoa_s
_register_thread_local_exe_atexit_callback
wcsncpy_s

Exports

Exports

_STWNDCloseConnection@4
_STWNDDeleteStateItem@4
_STWNDEndOfRequest@4
_STWNDGetLocalAddress@8
_STWNDGetLocalPort@4
_STWNDGetRemoteAddress@8
_STWNDGetRemotePort@4
_STWNDIsClientConnected@4
_STWNDSendResponse@24

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

10160c4206d23c504cd2301e332cef11

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mswsock

ole32

ws2_32

mscoree

webengine4

advapi32

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 22KB

.data Size: 512B - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.9MB

.text
Size: 22KB - Virtual size: 22KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.9MB