01c7908d6a8eab0aa069d75014c4481e2775c303ad164bdac83e143ec254fc13 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01c7908d6a8eab0aa069d75014c4481e2775c303ad164bdac83e143ec254fc13
Size

1.1MB
MD5

3a968565f33b90f4f6ba2c7b6b8bdca1
SHA1

3cb46d09a0ef2f327d2efbde3f029937c4739f34
SHA256

01c7908d6a8eab0aa069d75014c4481e2775c303ad164bdac83e143ec254fc13
SHA512

f9bc9cf651506b5975c5d08b938928eb779df6ce6aa78bc741ac33d5a3af4580feeb18c393bbdf7cc0a48fb5640c362bda772f68a0ad05398c8f6b1b0ab6034c
SSDEEP

24576:lnQAbFy13rQmDTAtu7/CIx9Hc1uNF4trkWTLVH:lQAM9rQWHczXTJH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01c7908d6a8eab0aa069d75014c4481e2775c303ad164bdac83e143ec254fc13

Files

01c7908d6a8eab0aa069d75014c4481e2775c303ad164bdac83e143ec254fc13
.exe windows:4 windows x86 arch:x86

c825d892ec1994311831ac7bb64ddf1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
WSAGetLastError
recv
socket
connect
send
closesocket

kernel32

Sleep
LoadLibraryA
GetProcAddress
TerminateThread
lstrlenA
MultiByteToWideChar
ExitProcess

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE