172e80ce817fb231ad907fe9ab872f7854e0884e2132eb47e28d7fe7c92fc643[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

172e80ce817fb231ad907fe9ab872f7854e0884e2132eb47e28d7fe7c92fc643.exe
Size

34KB
MD5

29f5d1aded278785c6aa49d9da7f2e59
SHA1

d801e3d1932cd5ea6e2ae669c724a4fa4f5ea0f2
SHA256

172e80ce817fb231ad907fe9ab872f7854e0884e2132eb47e28d7fe7c92fc643
SHA512

e0e7f796325db11f0766a9a3169191fc069e6b27d851c082809796ba602c8d98c7a4021fa154cdf2d2be7804ec0eff466b2ed9796ac6732287c0ae77e8f7e7dc
SSDEEP

768:Agt4v96rWPOSQGPL4vzZq2o9W7GsxBbPrK:7c9fOhGCq2iW7zO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
172e80ce817fb231ad907fe9ab872f7854e0884e2132eb47e28d7fe7c92fc643.exe

Files

172e80ce817fb231ad907fe9ab872f7854e0884e2132eb47e28d7fe7c92fc643.exe
.exe windows:6 windows x86 arch:x86

0cab81151513fa32becbc2e229a1f076

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\user1\Desktop\libirecovery\libirecovery\Release\irecover.pdb

Imports

libirecovery

irecv_exit
irecv_set_debug_level
irecv_close
irecv_get_device_info
irecv_strerror
irecv_get_mode
irecv_devices_get_device_by_client
irecv_open_with_ecid
irecv_getenv

kernel32

DecodePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
Sleep

msvcr120

_except_handler4_common
_controlfp_s
strtoull
__iob_func
printf
fprintf
strrchr
strchr
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_invoke_watson

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

z�֣u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0cab81151513fa32becbc2e229a1f076

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libirecovery

kernel32

msvcr120

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

z�֣u� Size: 16KB - Virtual size: 20KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB

z�֣u�
Size: 16KB - Virtual size: 20KB