bed50caecbe8d05d3ae453e2ab061cb8[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

bed50caecbe8d05d3ae453e2ab061cb8.zip
Size

10KB
MD5

9552d87bdc32c72169dba054914d261f
SHA1

22c653c71f00a7df31feb9d161e6a4a34be1f40d
SHA256

c1b12085b43bb87994d34d00e984f72e83076383ac0a9eea5e3beacf87246571
SHA512

20bed8704bc50e412d6298bdb1f375fedae3ab76b09a8e2733613ac2164995517f9befdb47e18c48d3ef745470bef350a810edd7a2dd8d92de152b1acdf10d98
SSDEEP

192:f2PdXmdAaxpAHRDQIyl2s07552/1cHrFSuheCnOPDH7uBQ/I2nbmbSmdMk:ezauRDQ/2s07a/1cL8L2OPmLvemdF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7161d538632fa04b2a4e6df091e364d1095696dd4060d8b98646bc6e36d80dbb

Files

bed50caecbe8d05d3ae453e2ab061cb8.zip
.zip

Password: infected
7161d538632fa04b2a4e6df091e364d1095696dd4060d8b98646bc6e36d80dbb
.exe windows:5 windows x86 arch:x86

Password: infected

432c342c05744facf1143abcda5d68c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ping_pong\win_client\Release\win_client.pdb

Imports

kernel32

Sleep
CreateProcessA
GetTempFileNameA
GetModuleFileNameA
CloseHandle
GetTempPathA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
InterlockedCompareExchange
InterlockedExchange
HeapSetInformation

shell32

ShellExecuteA

ws2_32

inet_addr
WSAGetLastError
htons
WSAStartup
recv
socket
send
connect
WSACleanup

msvcr100

printf
fopen
fread
rand
srand
fwrite
ftell
fseek
fclose
_time64
_snprintf
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
atoi
malloc
memset

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 686B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

432c342c05744facf1143abcda5d68c4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

ws2_32

msvcr100

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 916B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 1024B - Virtual size: 686B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 916B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 686B