152e642b8c63e7a4840b1cbe4a3f3470N[.]exe | Triage

Sharing

General

Target

152e642b8c63e7a4840b1cbe4a3f3470N.exe
Size

220KB
MD5

152e642b8c63e7a4840b1cbe4a3f3470
SHA1

f3e3bc8b7be6b9211169a4270375e32865b81e18
SHA256

fd9ab3432ee1603f3388a51a682704f7a163d7115a180890458ad2d68a536640
SHA512

b121393f443e5aa99379383c80ee256339b7d836432546d074403556f451f2447fd5f58e366bda66df912bf834bff70c8c1c2fe6c7beb7fbe29e3c1377e2540f
SSDEEP

3072:lBk8mIvuEPGb02TaQgei7iMeTqGfAG9oPfnMYXY6nfBPOW+HgpYXH6zRF:lBPQ0beTqGfAGKPf1XY6nfBPTxpYeF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
152e642b8c63e7a4840b1cbe4a3f3470N.exe

Files

152e642b8c63e7a4840b1cbe4a3f3470N.exe
.exe windows:4 windows x86 arch:x86

c825d892ec1994311831ac7bb64ddf1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
WSAGetLastError
recv
socket
connect
send
closesocket

kernel32

Sleep
LoadLibraryA
GetProcAddress
TerminateThread
lstrlenA
MultiByteToWideChar
ExitProcess

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE