0b538dcb1df636169b8965f8bc062b37[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

0b538dcb1df636169b8965f8bc062b37.exe
Size

290KB
MD5

0b538dcb1df636169b8965f8bc062b37
SHA1

e09dc4d56754cb65c77c17ee430c9b5fe95c480b
SHA256

c84a036a464797e523f1df99672125dfe61f7222fa62c9e7739fce9ea498a081
SHA512

ce5c653b61df71607296d7f9e2f008f8b63277b27c7e37f07952a66ec62271f8e9ed9ba9f2d661a6e59c2adc40272d54dc673fc05e1f25282cc131741e50db20
SSDEEP

6144:R1o12lUr7EbaK1fw9mdxEDZJ/wDAUZlYm3UhM9l:RC1ZobTw9yEDZJwDrPYmO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b538dcb1df636169b8965f8bc062b37.exe

Files

0b538dcb1df636169b8965f8bc062b37.exe
.exe windows:5 windows x86 arch:x86

3ce43dcc9f8226b50b65387f4477de91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\src\Tcpview\Release\Tcpview.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

gethostbyname
WSAGetLastError
socket
connect
send
recv
closesocket
WSAStartup
getservbyport
gethostname
gethostbyaddr
htons
htonl
ntohl
ntohs

iphlpapi

SetTcpEntry
GetTcpTable
GetUdpTable

comctl32

ImageList_Create
ord6
ord17
CreateToolbarEx
ImageList_ReplaceIcon

psapi

GetModuleFileNameExA

kernel32

ReadProcessMemory
CreateEventA
DeviceIoControl
GetCurrentProcessId
DuplicateHandle
GetCurrentProcess
CreateFileA
GetModuleFileNameA
GetLastError
GetNumberFormatA
GetLocaleInfoA
FormatMessageA
GetTickCount
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
GetUserDefaultLangID
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
GetVersion
InitializeCriticalSection
ExpandEnvironmentStringsA
GetConsoleCP
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CloseHandle
SetHandleCount
HeapSize
GetStdHandle
WriteFile
ExitProcess
Sleep
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
FatalAppExitA
DeleteCriticalSection
OpenProcess
LCMapStringA
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetCommandLineA
HeapReAlloc
ResumeThread
CreateThread
GetCurrentThreadId
ExitThread
HeapAlloc
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
ResetEvent
GetVersionExA
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
GetCommandLineW
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
GetConsoleMode
GetStringTypeA
LoadLibraryW
SetEvent
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
LCMapStringW
WaitForSingleObject
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetLocaleInfoW
SetEndOfFile
ReadFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileType
GetStringTypeW

user32

GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassA
LoadMenuA
InsertMenuA
CreateMenu
GetSubMenu
SetMenuItemInfoA
DrawMenuBar
PostQuitMessage
LoadStringA
DialogBoxParamA
TrackPopupMenu
RedrawWindow
UpdateWindow
DestroyIcon
SetDlgItemTextA
GetParent
ChildWindowFromPoint
InvalidateRect
SetCapture
ReleaseCapture
SetWindowLongA
GetWindowLongA
GetCursorPos
GetClientRect
CreateWindowExA
SetFocus
CallWindowProcA
GetSysColor
LoadAcceleratorsA
LoadIconA
DrawIconEx
InvalidateRgn
SetWindowPos
GetMenu
CheckMenuItem
SetTimer
KillTimer
GetWindowRect
IsIconic
IsZoomed
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
GetDC
DrawTextA
ReleaseDC
GetSystemMetrics
MoveWindow
ShowWindow
ClientToScreen
ScreenToClient
PostMessageA
DestroyWindow
DefWindowProcA
MessageBoxA
DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA
FillRect
EnableMenuItem

gdi32

GetTextMetricsA
SetBkMode
GetDeviceCaps
SetMapMode
StartDocA
EndDoc
EndPage
StartPage
SetTextColor
SelectObject
CreateFontIndirectA
DeleteDC
CreateCompatibleDC
GetObjectA
GetStockObject
DeleteObject
CreateSolidBrush
SetBkColor
GetBkColor

comdlg32

ChooseFontA
GetSaveFileNameA
PrintDlgA

advapi32

AllocateAndInitializeSid
GetTokenInformation
EqualSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ConvertSidToStringSidA
FlushTraceA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
FreeSid
RegOpenKeyExA
RegOpenKeyA

shell32

ShellExecuteExA
ShellExecuteA
SHGetFileInfoA
CommandLineToArgvW

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket

oleaut32

SysStringLen
SysFreeString
VariantClear
VariantInit
VariantChangeType
SafeArrayGetElement
SafeArrayDestroy
SafeArrayUnaccessData
CreateErrorInfo
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
GetErrorInfo
SetErrorInfo
SysAllocString

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ce43dcc9f8226b50b65387f4477de91

Headers

File Characteristics

PDB Paths

Imports

version

ws2_32

iphlpapi

comctl32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 232KB - Virtual size: 231KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 6KB - Virtual size: 17KB

.rsrc Size: 13KB - Virtual size: 13KB

.text
Size: 232KB - Virtual size: 231KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 6KB - Virtual size: 17KB

.rsrc
Size: 13KB - Virtual size: 13KB