fce85ece6efd64d5975a3495bd7d51a5154accf2d240d0cf541fd3647fbe0049N

Sharing

Copy URL Twitter E-mail

General

Target

fce85ece6efd64d5975a3495bd7d51a5154accf2d240d0cf541fd3647fbe0049N
Size

94KB
MD5

7954de8c855e0a85095c181214cf27a0
SHA1

b53f08756df690c05ada8448618098a9fa76d085
SHA256

fce85ece6efd64d5975a3495bd7d51a5154accf2d240d0cf541fd3647fbe0049
SHA512

fdd64032515ae1bf239af1abe5cc25d3d6e42bb67597ed1d87e658747c191d859a29977438086f21070beabc5bf1f266c0d5e0abd458cbfe5d9a11babc51f946
SSDEEP

1536:V0xbqA3F9NhCShzI3vdzPIz4tzhb3hqQ4yF/m2K0JTpqIGCq2iW7z:V0xbqA3FlCSS3vNIQaQ4yFu2K0JTpnGE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fce85ece6efd64d5975a3495bd7d51a5154accf2d240d0cf541fd3647fbe0049N

Files

fce85ece6efd64d5975a3495bd7d51a5154accf2d240d0cf541fd3647fbe0049N
.exe windows:6 windows x86 arch:x86

e6b8df64191fdf31b48134b2eb6bdc3f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\_sdks\libimobiledevice-vs\Win32\Release\ios_webkit_debug_proxy.pdb

Imports

ws2_32

WSACleanup
WSAStartup
closesocket
recv
socket
connect
htons
ioctlsocket
WSAGetLastError
send
getaddrinfo
listen
select
bind
setsockopt
__WSAFDIsSet
freeaddrinfo
gethostbyname
accept

plist

plist_to_bin
plist_from_bin
plist_new_data
plist_dict_next_item
plist_get_data_val
plist_copy
plist_new_bool
plist_new_uint
plist_get_bool_val
plist_get_node_type
plist_from_xml
plist_free
plist_dict_set_item
plist_new_string
plist_new_dict
plist_to_xml
plist_dict_get_item
plist_get_uint_val
plist_dict_get_size
plist_get_string_val
plist_dict_new_iter

imobiledevice

lockdownd_get_value
idevice_connect
lockdownd_start_service
idevice_free
lockdownd_client_free
lockdownd_client_new_with_handshake
idevice_new
idevice_connection_enable_ssl
idevice_connection_get_fd

getopt

optind
getopt_long_a
optarg_a

pcreposix

regexec
regcomp
regfree

ssleay32

ord78
ord58
ord108

vcruntime140

__current_exception_context
__current_exception
memmove
memcpy
strrchr
strchr
strstr
memset
_except_handler4_common

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
realloc
calloc
malloc

api-ms-win-crt-runtime-l1-1-0

_set_app_type
terminate
_initialize_narrow_environment
_configure_narrow_argv
_crt_atexit
_register_onexit_function
_initialize_onexit_table
perror
_seh_filter_exe
_initterm
_controlfp_s
_register_thread_local_exe_atexit_callback
_initterm_e
_get_initial_narrow_environment
_c_exit
_cexit
__p___argv
__p___argc
exit
signal
_exit
_wassert
_errno

api-ms-win-crt-string-l1-1-0

_strnicmp
strncmp
_stricmp
_strdup
tolower
strncpy

api-ms-win-crt-stdio-l1-1-0

fclose
fopen
_set_fmode
ferror
__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vsprintf
__p__commode
_open
_read
_close
getc
__stdio_common_vfprintf

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr
_libm_sse2_log10_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

GetCurrentProcessId
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

^��=�u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e6b8df64191fdf31b48134b2eb6bdc3f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

plist

imobiledevice

getopt

pcreposix

ssleay32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 2KB

^��=�u� Size: 16KB - Virtual size: 20KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 2KB

^��=�u�
Size: 16KB - Virtual size: 20KB