13c841255f00d2d2468207b65c63a10b09bb9c330636935a96250a4751d38157N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

13c841255f00d2d2468207b65c63a10b09bb9c330636935a96250a4751d38157N
Size

252KB
MD5

caf451422e41311ea597e3b695b1c7b0
SHA1

2de97dc12a78d83ab9489eae6db75cb045b86b2a
SHA256

13c841255f00d2d2468207b65c63a10b09bb9c330636935a96250a4751d38157
SHA512

dac6e207af3c1fb3e1e823124e1211c3116e528e7a29383f2f3752571fd3acce23a65f12c78cfe581c83b5afa2d1eda4fae5c46ab3c887ed4e33b5bc2ae6dd55
SSDEEP

6144:lBPQZN9D1cY72aMAlMwfMufSjrimtbQKBN3a8jS:l+58yMqf2Ztb36

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13c841255f00d2d2468207b65c63a10b09bb9c330636935a96250a4751d38157N

Files

13c841255f00d2d2468207b65c63a10b09bb9c330636935a96250a4751d38157N
.exe windows:4 windows x86 arch:x86

c825d892ec1994311831ac7bb64ddf1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
WSAGetLastError
recv
socket
connect
send
closesocket

kernel32

Sleep
LoadLibraryA
GetProcAddress
TerminateThread
lstrlenA
MultiByteToWideChar
ExitProcess

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE