29d87bfdb20c7460960e20294a1887c622b3fb335b30406b0757cd990e700b49N

Sharing

Copy URL Twitter E-mail

General

Target

29d87bfdb20c7460960e20294a1887c622b3fb335b30406b0757cd990e700b49N
Size

61KB
MD5

3dd94955c5de7770787fe1839de59560
SHA1

058ceffb476295d145618a6fcf528accabe68797
SHA256

29d87bfdb20c7460960e20294a1887c622b3fb335b30406b0757cd990e700b49
SHA512

44da0d290e3ab0cd680d7a306df49033c8ea68b88d55da4d583321e60b43fe643889b36df49102d189800c404b9c8f19efb7bbcef1c78c9dc06c79f1d8db010e
SSDEEP

768:wgX1rnqLns88XCRjS9Y5xcdCpDSGpg2l9oZO1sBiuCdrJMwva6CvwEBRMOogY:3nMs8lca3pR+OWCdr9C6p2RogY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29d87bfdb20c7460960e20294a1887c622b3fb335b30406b0757cd990e700b49N

Files

29d87bfdb20c7460960e20294a1887c622b3fb335b30406b0757cd990e700b49N
.exe windows:4 windows x86 arch:x86

9a07a268dfdfe636c092c15eecfb3042

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
GetLastError
CreateThread
CreatePipe
CreateProcessA
DuplicateHandle
GetCurrentProcess
ExitThread
Sleep
ReadFile
PeekNamedPipe
WriteFile
GetStdHandle
FreeConsole
VirtualFree
VirtualAlloc
LCMapStringA
SetEndOfFile
LCMapStringW
CreateFileA
GetNumberOfConsoleInputEvents
PeekConsoleInputA
HeapReAlloc
LoadLibraryA
GetStringTypeW
GetStringTypeA
GetProcAddress
SetStdHandle
SetEnvironmentVariableA
SetFilePointer
CompareStringA
GetOEMCP
CompareStringW
GetCPInfo
GetEnvironmentStringsW
GetACP
HeapFree
HeapAlloc
CloseHandle
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
RtlUnwind
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar

wsock32

__WSAFDIsSet
getsockname
select
listen
WSASetLastError
recvfrom
accept
bind
socket
setsockopt
getservbyport
connect
htons
ioctlsocket
ntohs
getservbyname
gethostbyaddr
gethostbyname
inet_addr
WSACleanup
WSAGetLastError
WSAStartup
closesocket
recv
send

Sections

.text
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.encoder
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9a07a268dfdfe636c092c15eecfb3042

Headers

File Characteristics

Imports

kernel32

wsock32

Sections

.text Size: 37KB - Virtual size: 40KB

.rdata Size: 1KB - Virtual size: 4KB

.data Size: 15KB - Virtual size: 24KB

.idata Size: 1KB - Virtual size: 4KB

.encoder Size: 4KB - Virtual size: 4KB

.text
Size: 37KB - Virtual size: 40KB

.rdata
Size: 1KB - Virtual size: 4KB

.data
Size: 15KB - Virtual size: 24KB

.idata
Size: 1KB - Virtual size: 4KB

.encoder
Size: 4KB - Virtual size: 4KB