SecuriteInfo[.]com[.]Trojan[.]MulDrop28[.]3097[.]13525[.]30211[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.MulDrop28.3097.13525.30211.exe
Size

6.5MB
MD5

f2908c73543719738bea99c02fdafe00
SHA1

2fc8790129fa21cb76642cbd7ab04fc1783e911b
SHA256

be9862ad765af7e71a322549640747a6952c4e8bc18b6568c4781df33f0bbfd6
SHA512

fa9d5987ef0f9f14d98d5070e09d980e944e4f06966b2601a3b01bfe95a0df239305bd4dad292a8808e6dee6e02d0d33079eda2ddb668ba31d2a9949173a2a31
SSDEEP

196608:HSpxdHp8lQbLfamxV06mpg2fsT0A0F+kuwN9:4HamxVBmpdfsT0q4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.MulDrop28.3097.13525.30211.exe

Files

SecuriteInfo.com.Trojan.MulDrop28.3097.13525.30211.exe
.exe windows:6 windows x86 arch:x86

add63f909d344437ae54d223c75de68e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

GetUserNameA

shell32

ShellExecuteA

ole32

CoCreateInstance

ws2_32

send

Sections

.MPRESS1
Size: 6.4MB - Virtual size: 19.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE