c8fb6bac01166065de459c1516d9e1d198c47c4320a1399737991ee30ae5557d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c8fb6bac01166065de459c1516d9e1d198c47c4320a1399737991ee30ae5557d.exe
Size

356KB
MD5

e5988b4edc14c95894516402c4c0b758
SHA1

6cc5f9667ee3c5fbd5e78aaf3fa005e0beb5dd55
SHA256

c8fb6bac01166065de459c1516d9e1d198c47c4320a1399737991ee30ae5557d
SHA512

9a5cb38a8117f94d9abe931aea333fe70e49e7045500d0e2d37ce425a88b76a86f1a9777764a47ad8e65270558c0f60d02e8cffa2f1bfb2b23e13b39e2ffcedb
SSDEEP

6144:XYhEwyA0IYhEwyA0KYhEwyA0eYhEwyA0:XYhlyA0IYhlyA0KYhlyA0eYhlyA0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8fb6bac01166065de459c1516d9e1d198c47c4320a1399737991ee30ae5557d.exe

Files

c8fb6bac01166065de459c1516d9e1d198c47c4320a1399737991ee30ae5557d.exe
.exe windows:10 windows x86 arch:x86

6a3e1358bc46591e817a18e666b710e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

nslookup.pdb

Imports

msvcrt

__p__commode
_XcptFilter
_initterm
exit
_write
?terminate@@YAXXZ
_amsg_exit
getenv
isspace
strncmp
fgets
_strnicmp
__getmainargs
strncpy_s
fopen
__set_app_type
_controlfp
fputc
strchr
system
sscanf_s
perror
_except_handler4_common
fflush
sprintf_s
_exit
putchar
gmtime
_cexit
strcat_s
fputs
__p__fmode
__setusermatherr
strcpy_s
putc
malloc
fread
free
printf
fwrite
fprintf
__iob_func
_vsnprintf_s
getc
realloc
ferror
memcpy
fclose
memset

ws2_32

getservbyport
getprotobynumber
WSAGetLastError
getaddrinfo
recv
connect
socket
gethostname
send
htons
closesocket
select
ntohs
inet_ntoa
freeaddrinfo
WSAStartup
htonl

dnsapi

DnsFreeConfigStructure
DnsQueryConfigAllocEx

api-ms-win-core-localization-l1-2-0

FormatMessageA
SetThreadUILanguage

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegCloseKey

mswsock

s_perror

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

EtwTraceMessageVa
RtlIpv6StringToAddressExA
RtlIpv6AddressToStringExA
RtlIpv4AddressToStringExA
RtlIpv6AddressToStringA
RtlIpv4StringToAddressA
NtQueryValueKey
RtlInitString
RtlFreeHeap
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
NtOpenKey
RtlAllocateHeap
RtlAnsiStringToUnicodeString

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 1024B - Virtual size: 569B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a3e1358bc46591e817a18e666b710e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ws2_32

dnsapi

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

mswsock

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 48KB - Virtual size: 47KB

.wpp_sf Size: 1024B - Virtual size: 569B

.data Size: 14KB - Virtual size: 18KB

.idata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 48KB - Virtual size: 47KB

.wpp_sf
Size: 1024B - Virtual size: 569B

.data
Size: 14KB - Virtual size: 18KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB