779146421fdbd94207ea328601258e5aa2d53bc48f067fd9ce0f043aff505607N

General

Target

779146421fdbd94207ea328601258e5aa2d53bc48f067fd9ce0f043aff505607N
Size

84KB
MD5

b349aaa2c126a51ac9f9936bfad87100
SHA1

8e9dae33a2cba782d8eaa09270e3714e59b7ae00
SHA256

779146421fdbd94207ea328601258e5aa2d53bc48f067fd9ce0f043aff505607
SHA512

d480368d003407a55035724ceba512b61306d0fa727bc17115712d55be1b86101770e6c901e6c3adb9ac03dddddb74cad8a9de6f9ebb38df9ac415336828b2dd
SSDEEP

1536:fpk0pxCbU5jW20fy+C1iYdAD8GXN+I7fJ+aCl1fem:3CbcS20K+C1iYWzoI7h+aS1Gm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
779146421fdbd94207ea328601258e5aa2d53bc48f067fd9ce0f043aff505607N

Files

779146421fdbd94207ea328601258e5aa2d53bc48f067fd9ce0f043aff505607N
.exe windows:5 windows x86 arch:x86

99657691b0e594d2a789996abb8500a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
ReadFile
GetOverlappedResult
WaitForMultipleObjects
WriteFile
CreateEventA
GetLastError
CreateFileA
GetModuleHandleA
GetCommandLineA
GetVersionExA
HeapAlloc
HeapFree
ExitProcess
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetFilePointer
GetACP
GetOEMCP
GetCPInfo
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
SetStdHandle
LCMapStringA
LCMapStringW
RtlUnwind
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
FlushFileBuffers
CloseHandle
FormatMessageA
LocalFree

ws2_32

gethostbyaddr
ntohs
getservbyport
WSACleanup
recv
recvfrom
send
sendto
closesocket
accept
htons
select
listen
getsockname
getpeername
connect
bind
socket
setsockopt
WSAStartup
getservbyname
htonl
inet_addr
inet_ntoa
__WSAFDIsSet
WSAGetLastError
gethostbyname

ntdll

RtlIpv4StringToAddressA
RtlIpv6StringToAddressA

mswsock

TransmitFile
s_perror

user32

CharToOemBuffA

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99657691b0e594d2a789996abb8500a0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

ntdll

mswsock

user32

Sections

.text Size: 37KB - Virtual size: 36KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 43KB - Virtual size: 43KB

.text
Size: 37KB - Virtual size: 36KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 43KB - Virtual size: 43KB