a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0 | Triage

Sharing

General

Target

a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0
Size

371KB
MD5

87d5535c6d94bef127f82f5fff6497bd
SHA1

a83ec32dfb1c590ebfd6e3233d81a0f3cbac0994
SHA256

a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0
SHA512

f37502876aaeaeb7b3e2e842485e7e00c6fcf5206824548970ec011a40f7303d8e48898069f36376dc92165f0652d4d890cc55cf46200af6191dc9598323bf65
SSDEEP

768:CU41Hv11ZX47nelShWFhdEod+QZnpLtx+:81HBoClShWFhdl+QdjQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0

Files

a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0
.exe windows:6 windows x86 arch:x86

ebe827f025272474986b717e1ee82915

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrIA

ws2_32

htons
sendto
WSAStartup
socket
closesocket

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
lstrcpyA
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetProcessId
IsProcessorFeaturePresent
MultiByteToWideChar
CloseHandle
Sleep
lstrcmpiW

advapi32

CryptEncrypt
CryptGenRandom

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ