95b42b6d8880c9471bcfdea5a8f0d1c302f7ad6d1ce8ce7238a9cfbeb4b986e2

Sharing

Copy URL Twitter E-mail

General

Target

95b42b6d8880c9471bcfdea5a8f0d1c302f7ad6d1ce8ce7238a9cfbeb4b986e2
Size

111KB
MD5

c0783e30a0667375bbdc32f34698fea9
SHA1

fb522acd43de0b84befa7f1deff7fd19e17225d1
SHA256

95b42b6d8880c9471bcfdea5a8f0d1c302f7ad6d1ce8ce7238a9cfbeb4b986e2
SHA512

c0581d2b80de1130cc381198e417c4e40ee69b4cd31b1592a29630bd1c96a7bb7970f371d46168c787dd81b220fd87db55fc47c1314713f928954887b0217ede
SSDEEP

3072:MMyB2kZvCWBx/wPLGqG1wvMCnZI2M0euD52EU08TV:MnbCWHMG2vMsU0WV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95b42b6d8880c9471bcfdea5a8f0d1c302f7ad6d1ce8ce7238a9cfbeb4b986e2

Files

95b42b6d8880c9471bcfdea5a8f0d1c302f7ad6d1ce8ce7238a9cfbeb4b986e2
.exe windows:6 windows x86 arch:x86

eae80815b6c41c626978580093f5dacd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\CppBackdoor\MEAndPS\TowExeBuild\CilentLoader\Release\CilentLoader.pdb

Imports

ws2_32

recv
WSACleanup
closesocket
gethostbyname
WSAStartup
inet_addr
send
socket
connect
inet_ntoa
htons

kernel32

WriteFile
CreateFileW
CloseHandle
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
HeapCreate
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteConsoleW
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
LCMapStringW
GetProcessHeap

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eae80815b6c41c626978580093f5dacd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

Sections

.text Size: 74KB - Virtual size: 74KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 2KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 74KB - Virtual size: 74KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 2KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB