2024-09-09_d65cb30e847bea054daab2a58be9f989_conti | Triage

Sharing

General

Target

2024-09-09_d65cb30e847bea054daab2a58be9f989_conti
Size

371KB
MD5

d65cb30e847bea054daab2a58be9f989
SHA1

561df1c57fdc551cada734291caaa2b2ade5280d
SHA256

410289d2ae3ea505ffadda0d816720adcc71fce7f38dd319cd4788cad05e9bd8
SHA512

694449ae0ae4b076b416e0c84539f720d13f26cf190db768c310926069e18298b636eec53b244af1c76008bc24c6aa91dd54d6c2150f5dac58ff3ffe1dbe10b5
SSDEEP

768:CR41Vq611ZX47nJFwQzbFhd8od+QZn6su0tx+llMh:J10IoEIbFhd9+QdppQllMh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-09_d65cb30e847bea054daab2a58be9f989_conti

Files

2024-09-09_d65cb30e847bea054daab2a58be9f989_conti
.exe windows:6 windows x86 arch:x86

ebe827f025272474986b717e1ee82915

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrIA

ws2_32

htons
sendto
WSAStartup
socket
closesocket

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
lstrcpyA
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetProcessId
IsProcessorFeaturePresent
MultiByteToWideChar
CloseHandle
Sleep
lstrcmpiW

advapi32

CryptEncrypt
CryptGenRandom

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ