2baecd6bbd065f930ef30eec978b20b3b8611884fd10852834e7fc593765ee75

Sharing

Copy URL

Twitter E-mail

General

Target

2baecd6bbd065f930ef30eec978b20b3b8611884fd10852834e7fc593765ee75
Size

151KB
MD5

29ced56330073921e0bff677f98c06c4
SHA1

a7b92f8b3a43239ed70be0cde6989afec9b41630
SHA256

2baecd6bbd065f930ef30eec978b20b3b8611884fd10852834e7fc593765ee75
SHA512

0b71f34a72b3f2ee747d8c32a3df4125b5b18e2ae794dcc669a4b1354ec2084b320028d1b4a868ce5f1cf93e31bbb716e39f98ffb1868c4adbc0958666460910
SSDEEP

3072:6fktJbBiYBN6DQHKMk4ZU52XQckKDZMwuyoWVB22UipizpcbLt0gqHC4cLUEw:Uk/b/vKMVZU8JdOwqW722UipgcbRxqis

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Transfer.exe

Files

2baecd6bbd065f930ef30eec978b20b3b8611884fd10852834e7fc593765ee75
.zip

Password: infected
Transfer.exe
.exe windows:5 windows x86 arch:x86

3ce43dcc9f8226b50b65387f4477de91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\src\Tcpview\Release\Tcpview.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

gethostbyname
WSAGetLastError
socket
connect
send
recv
closesocket
WSAStartup
getservbyport
gethostname
gethostbyaddr
htons
htonl
ntohl
ntohs

iphlpapi

SetTcpEntry
GetTcpTable
GetUdpTable

comctl32

ImageList_Create
ord6
ord17
CreateToolbarEx
ImageList_ReplaceIcon

psapi

GetModuleFileNameExA

kernel32

ReadProcessMemory
CreateEventA
DeviceIoControl
GetCurrentProcessId
DuplicateHandle
GetCurrentProcess
CreateFileA
GetModuleFileNameA
GetLastError
GetNumberFormatA
GetLocaleInfoA
FormatMessageA
GetTickCount
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
GetUserDefaultLangID
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
GetVersion
InitializeCriticalSection
ExpandEnvironmentStringsA
GetConsoleCP
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CloseHandle
SetHandleCount
HeapSize
GetStdHandle
WriteFile
ExitProcess
Sleep
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
FatalAppExitA
DeleteCriticalSection
OpenProcess
LCMapStringA
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetCommandLineA
HeapReAlloc
ResumeThread
CreateThread
GetCurrentThreadId
ExitThread
HeapAlloc
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
ResetEvent
GetVersionExA
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
GetCommandLineW
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
GetConsoleMode
GetStringTypeA
LoadLibraryW
SetEvent
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
LCMapStringW
WaitForSingleObject
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetLocaleInfoW
SetEndOfFile
ReadFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileType
GetStringTypeW

user32

GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassA
LoadMenuA
InsertMenuA
CreateMenu
GetSubMenu
SetMenuItemInfoA
DrawMenuBar
PostQuitMessage
LoadStringA
DialogBoxParamA
TrackPopupMenu
RedrawWindow
UpdateWindow
DestroyIcon
SetDlgItemTextA
GetParent
ChildWindowFromPoint
InvalidateRect
SetCapture
ReleaseCapture
SetWindowLongA
GetWindowLongA
GetCursorPos
GetClientRect
CreateWindowExA
SetFocus
CallWindowProcA
GetSysColor
LoadAcceleratorsA
LoadIconA
DrawIconEx
InvalidateRgn
SetWindowPos
GetMenu
CheckMenuItem
SetTimer
KillTimer
GetWindowRect
IsIconic
IsZoomed
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
GetDC
DrawTextA
ReleaseDC
GetSystemMetrics
MoveWindow
ShowWindow
ClientToScreen
ScreenToClient
PostMessageA
DestroyWindow
DefWindowProcA
MessageBoxA
DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA
FillRect
EnableMenuItem

gdi32

GetTextMetricsA
SetBkMode
GetDeviceCaps
SetMapMode
StartDocA
EndDoc
EndPage
StartPage
SetTextColor
SelectObject
CreateFontIndirectA
DeleteDC
CreateCompatibleDC
GetObjectA
GetStockObject
DeleteObject
CreateSolidBrush
SetBkColor
GetBkColor

comdlg32

ChooseFontA
GetSaveFileNameA
PrintDlgA

advapi32

AllocateAndInitializeSid
GetTokenInformation
EqualSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ConvertSidToStringSidA
FlushTraceA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
FreeSid
RegOpenKeyExA
RegOpenKeyA

shell32

ShellExecuteExA
ShellExecuteA
SHGetFileInfoA
CommandLineToArgvW

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket

oleaut32

SysStringLen
SysFreeString
VariantClear
VariantInit
VariantChangeType
SafeArrayGetElement
SafeArrayDestroy
SafeArrayUnaccessData
CreateErrorInfo
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
GetErrorInfo
SetErrorInfo
SysAllocString

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

3ce43dcc9f8226b50b65387f4477de91

Headers

File Characteristics

PDB Paths

Imports

version

ws2_32

iphlpapi

comctl32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 232KB - Virtual size: 231KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 6KB - Virtual size: 17KB

.rsrc Size: 14KB - Virtual size: 14KB

.text
Size: 232KB - Virtual size: 231KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 6KB - Virtual size: 17KB

.rsrc
Size: 14KB - Virtual size: 14KB