7b8d4a142bd2e159d4372e69b52b6ba7f9aea05c8296b3a507ec94af050b39f4N

Sharing

Copy URL Twitter E-mail

General

Target

7b8d4a142bd2e159d4372e69b52b6ba7f9aea05c8296b3a507ec94af050b39f4N
Size

110KB
MD5

6238b032183619b9b16b25c672c547a0
SHA1

d2c7d0e176cb2310bb9561c996287e196c94c2a4
SHA256

7b8d4a142bd2e159d4372e69b52b6ba7f9aea05c8296b3a507ec94af050b39f4
SHA512

ce5998fc611b4c63dbb8159a107971cd9d9ce2e2660ed1efee5ec4fe78fdb2ca3890352c8e55cd38b40ad26dadedd8de0a0962d4f2c216b7beecbb36beccf2dd
SSDEEP

1536:b+k/qxv16NC3QULz+B0C/A3gASnZENlVwRGwRUY8QmsZ9O2y8TF6:bFqVkwQULz+Bpop6ENIRUlsZ9OY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b8d4a142bd2e159d4372e69b52b6ba7f9aea05c8296b3a507ec94af050b39f4N

Files

7b8d4a142bd2e159d4372e69b52b6ba7f9aea05c8296b3a507ec94af050b39f4N
.exe windows:6 windows x86 arch:x86

a90732fe981ccf905022fe3e10877e2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

nslookup.pdb

Imports

advapi32

RegCloseKey

kernel32

FormatMessageA
LocalFree
SetLastError
ExpandEnvironmentStringsA
LocalAlloc
GetLastError
WaitForSingleObject
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
HeapSetInformation
SetThreadUILanguage
ReleaseMutex

msvcrt

_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
perror
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__getmainargs
system
sprintf_s
putc
_write
fputs
fwrite
getc
ferror
fread
realloc
malloc
fputc
fflush
getenv
strcat_s
fopen
fgets
isspace
strncmp
_strnicmp
printf
putchar
strncpy_s
strchr
memset
fprintf
fclose
sscanf
free
strcpy_s
_iob
exit
_vsnprintf
gmtime
memcpy

wsock32

ord1108
htonl
gethostname
select
socket
connect
send
recv
closesocket
ntohs
inet_addr
getprotobynumber
htons
getservbyport
WSAStartup
WSAGetLastError

ws2_32

getaddrinfo
freeaddrinfo

user32

CharToOemBuffA

dnsapi

DnsQueryConfigAllocEx
DnsFreeConfigStructure

ntdll

RtlIpv4StringToAddressA
RtlIpv6AddressToStringA
RtlIpv6StringToAddressExA
RtlIpv6AddressToStringExA
RtlIpv4AddressToStringExA
RtlFreeUnicodeString
NtOpenKey
RtlAnsiStringToUnicodeString
RtlInitString
RtlUnicodeStringToAnsiString
NtQueryValueKey
RtlFreeHeap
RtlAllocateHeap

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 13KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a90732fe981ccf905022fe3e10877e2f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

wsock32

ws2_32

user32

dnsapi

ntdll

Sections

.text Size: 59KB - Virtual size: 58KB

.data Size: 13KB - Virtual size: 31KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 33KB - Virtual size: 34KB

.text
Size: 59KB - Virtual size: 58KB

.data
Size: 13KB - Virtual size: 31KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 33KB - Virtual size: 34KB