f00d363d292d0e9500e055df0d1e95ecab1191070010a34b5a02eb3f5cf6f4b8N | Triage

Sharing

General

Target

f00d363d292d0e9500e055df0d1e95ecab1191070010a34b5a02eb3f5cf6f4b8N
Size

326KB
MD5

67272bdf9b8d38ee27ede57bef257400
SHA1

5547a87222800f91b8d1ca6d88f34abb966099d8
SHA256

f00d363d292d0e9500e055df0d1e95ecab1191070010a34b5a02eb3f5cf6f4b8
SHA512

041ecafa85349710230753ec135b4e30d3ee7feba2b2e686c4ef101846f0ecf59799b94ccd075be0a1c866404d0f527e97fa1e42da162f880cba648500efd1fa
SSDEEP

6144:BBPQHfeHLJDRO6t9RdRzySfBE8Vg9PxB7OniGWuO37yDe4/z:BcQD00Hya0PT7yijF7mBL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f00d363d292d0e9500e055df0d1e95ecab1191070010a34b5a02eb3f5cf6f4b8N

Files

f00d363d292d0e9500e055df0d1e95ecab1191070010a34b5a02eb3f5cf6f4b8N
.exe windows:4 windows x86 arch:x86

c825d892ec1994311831ac7bb64ddf1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
WSAGetLastError
recv
socket
connect
send
closesocket

kernel32

Sleep
LoadLibraryA
GetProcAddress
TerminateThread
lstrlenA
MultiByteToWideChar
ExitProcess

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE