10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c

General

Target
10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c
Size 152KB
Sample241017-xdqsrssfjj
SHA256 10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c
MD5 4f5960b609152a8693a7b33d2258c2c7
SHA1 25e5d25174980031926945db971863623267054e
SHA512 ef0aaa6568574a4080970f4b61f4d94134862ecd868e6ca8398e9c51defef87b3858eff9273c4db6a5f3383eb519d8d9047684399bfa63633311056f7b5979bb
SSDEEP 3072:VHX2gl7RdCtU/5rxheZ8rU3iGcVb1cqFim2voQ:VHGgl7RPXe+rUDdqF6vh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c

File Explorer

10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c

.dll 152KB

10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c

IMPHASH 3db59ea325c7780e04601ef192430c80
SHA256 10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c
MD5 4f5960b609152a8693a7b33d2258c2c7
SHA1 25e5d25174980031926945db971863623267054e
SHA512 ef0aaa6568574a4080970f4b61f4d94134862ecd868e6ca8398e9c51defef87b3858eff9273c4db6a5f3383eb519d8d9047684399bfa63633311056f7b5979bb
SSDEEP 3072:VHX2gl7RdCtU/5rxheZ8rU3iGcVb1cqFim2voQ:VHGgl7RPXe+rUDdqF6vh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

102400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\薛少波_资料\VS2005\Levi驱动\PLCDrivers\OUT\emudrivers\AB_DF1_EthernetIP.pdb

ws2_32

socket htons connect closesocket

kernel32

GetOEMCP FlushFileBuffers CloseHandle Sleep HeapAlloc GetLastError HeapFree GetSystemTimeAsFileTime InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCPInfo GetACP LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA GetStringTypeW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSection RtlUnwind LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode HeapSize GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

Name

.text

Size

60KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

10d487a801a40dda433715b72babf53ff18f3d997ddad119b6bd34eaf0a9472c

ws2_32

kernel32

generic