8589f5f5968cf39ef3e12e35ca9393f0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8589f5f5968cf39ef3e12e35ca9393f0N.exe
Size

30KB
MD5

8589f5f5968cf39ef3e12e35ca9393f0
SHA1

7290a9fce1ed5bdf5e2bdc08b1341fc84bb22650
SHA256

7e6cf0987105ce3583ae9f3d54d73ba96f2b0678b3263faf9777cb3d58461fc6
SHA512

837d4277b41a9ca334e4748579318fe3006f95a49b22b6d41103a990d842ba0875a1a3edbe3aecec33aad7790033f10958dc18482cd03d8cdaec86499ef168a9
SSDEEP

384:n9tSPvHAB3+nvn3w86bt02mj+cmI7/1s/yCHT7Hvj9baTuqpEw1qVMHIT:n9tSPvHiOnvFEt0BmmXCZguAYVV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8589f5f5968cf39ef3e12e35ca9393f0N.exe

Files

8589f5f5968cf39ef3e12e35ca9393f0N.exe
.dll windows:6 windows x64 arch:x64

cb62711d0a6ad219307086308dfb1764

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Temp\perl-5.28.0\lib\auto\Socket\Socket.pdb

Imports

perl528

win32_ntohs
win32_gethostbyname
Perl_newXS_deffile
Perl_newCONSTSUB
Perl_newSVpvf_nocontext
Perl_hv_common
Perl_hv_common_key_len
Perl_sv_2pv_flags
Perl_newSViv
Perl_croak_sv
Perl_sv_2iv_flags
PL_charclass
Perl_stack_grow
Perl_newSV_type
Perl_sv_setpvn
Perl_croak_nocontext
Perl_mro_method_changed_in
Perl_croak_xs_usage
Perl_sv_setiv
win32_htons
Perl_newSVpvf
Perl_sv_free2
Perl_xs_boot_epilog
Perl_xs_handshake
Perl_sv_upgrade
Perl_sv_2uv_flags
Perl_sv_2mortal
PL_hexdigit
Perl_sv_2pvbyte
win32_htonl
Perl_block_gimme
Perl_sv_utf8_downgrade
Perl_sv_newmortal
Perl_newSVpvn_flags
Perl_get_hv
Perl_newSVpvn
Perl_get_context

ws2_32

WSAStringToAddressA
WSASetLastError
WSAAddressToStringA

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
strchr
memset
memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table

kernel32

GetCurrentProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
RtlLookupFunctionEntry
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext

Exports

Exports

boot_Socket

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb62711d0a6ad219307086308dfb1764

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

perl528

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 768B

.reloc Size: 1024B - Virtual size: 600B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 768B

.reloc
Size: 1024B - Virtual size: 600B