6b2f143a0b9528c9d5067825ee226b30N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6b2f143a0b9528c9d5067825ee226b30N.exe
Size

885KB
MD5

6b2f143a0b9528c9d5067825ee226b30
SHA1

e35fbad5781454a275683eb6ff8c098ece6f177c
SHA256

fa100f76a106b9c43c34c9a952530a8594358b696f41e9354bc6ca2cb7bdb164
SHA512

cc88dfac695a3af7f0af516a7679509b79f1f88470bc8d99b7793001a3b80f1e8005bd2d8e560add9d3403d84c281651932de9662d2d3c9d08f45876202852ce
SSDEEP

24576:luXg4N6r54Z6uoYcSPDvYA6QNnY9aizN+ljHwBg:lbHruHvPDvdGrJ+ljwBg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b2f143a0b9528c9d5067825ee226b30N.exe

Files

6b2f143a0b9528c9d5067825ee226b30N.exe
.exe windows:4 windows x86 arch:x86

c825d892ec1994311831ac7bb64ddf1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
WSAGetLastError
recv
socket
connect
send
closesocket

kernel32

Sleep
LoadLibraryA
GetProcAddress
TerminateThread
lstrlenA
MultiByteToWideChar
ExitProcess

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE