e5435aff967434e5e114920d17dbbc6e0844e6826dfb52a7f7f34a630f2f8639

Sharing

Copy URL Twitter E-mail

General

Target

e5435aff967434e5e114920d17dbbc6e0844e6826dfb52a7f7f34a630f2f8639
Size

2.8MB
MD5

a8c2f50698afd1be1560d2f770255956
SHA1

9070090ae94e876256af01b791e163c098b20305
SHA256

e5435aff967434e5e114920d17dbbc6e0844e6826dfb52a7f7f34a630f2f8639
SHA512

28282f08b7cf5c2ee05dd3a7dd6434525d723a75acc9a18afeeeda83d8680842df232a8733433dd954558a55fa6f919c998a8e30bcef87217d4a97c6411c42c4
SSDEEP

49152:NGp7tAMjtj0X20B9LBVCXHePrFMV1dS2s8PYufkMjN2YmSQ7grmZ/qWuBY:4p7tAEyx1WezFWSJ8NfZNxmSiOY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5435aff967434e5e114920d17dbbc6e0844e6826dfb52a7f7f34a630f2f8639

Files

e5435aff967434e5e114920d17dbbc6e0844e6826dfb52a7f7f34a630f2f8639
.exe windows:6 windows x86 arch:x86

1208288a5efe294a900cda244cd74b1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ProgramData\Jenkins\.jenkins\workspace\CCMini_Windows\Win32\Products\Release_Win32\CCMini.pdb

Imports

ws2_32

gethostbyname
socket
setsockopt
send
recv
listen
WSAStartup
htonl
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
htons
select
ntohs
getsockname
WSAGetLastError

shell32

CommandLineToArgvW

kernel32

SetStdHandle
GetProcessHeap
GetCommandLineW
Sleep
EnterCriticalSection
GetModuleFileNameW
HeapSize
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
WaitForSingleObject
TerminateThread
CloseHandle
SetEnvironmentVariableW
CreateFileW
LeaveCriticalSection
InitializeSListHead
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
EncodePointer
DecodePointer
InitializeCriticalSectionEx
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
WriteConsoleW
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
GetStdHandle
WriteFile
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP

audioengine

CreateAudioService
SetCCMiniRootDir

Sections

.text
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1208288a5efe294a900cda244cd74b1e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

shell32

kernel32

audioengine

Sections

.text Size: 214KB - Virtual size: 213KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 5KB - Virtual size: 26KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 214KB - Virtual size: 213KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 5KB - Virtual size: 26KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 10KB - Virtual size: 10KB