buildp[.]exe | Triage™

General

Target
buildp.exe
Size 841KB
Sample220421-3vt5eadffr
SHA256 72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d
MD5 efed57771cb41fdde63781d1e195912c
SHA1 a71b0545951c99eb6ad4a50c22d02c958003d920
SHA512 6fd84f80ba5f3c53f48a6a0135cedc7b489cca419742e043116468bcda0898398dd7ddff4ac7d0d8b283312d4c411790b8ff74276f14016021597498b306a080
SSDEEP 12288:T6yGAUcLloo2XL1xe6OVrkfi6UgyN1QGNrGgMup2VymX8doloUw4mSrT9n8nvunJ:uZcLKoAL1s6OVrITCPp2V5oYmSunIwE
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

buildp.exe

.exe 841KB

buildp.exe

IMPHASH 3639259efd599d699775c282eb58d000
SHA256 72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d
MD5 efed57771cb41fdde63781d1e195912c
SHA1 a71b0545951c99eb6ad4a50c22d02c958003d920
SHA512 6fd84f80ba5f3c53f48a6a0135cedc7b489cca419742e043116468bcda0898398dd7ddff4ac7d0d8b283312d4c411790b8ff74276f14016021597498b306a080
SSDEEP 12288:T6yGAUcLloo2XL1xe6OVrkfi6UgyN1QGNrGgMup2VymX8doloUw4mSrT9n8nvunJ:uZcLKoAL1s6OVrITCPp2V5oYmSunIwE
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19675

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetMailslotInfo LocalFlags LoadLibraryW InterlockedPopEntrySList LeaveCriticalSection WriteConsoleW lstrlenW GetShortPathNameA CreateDirectoryA GetConsoleAliasesW GetStdHandle GetCPInfoExW FillConsoleOutputCharacterW SetLastError SetConsoleTextAttribute WriteProfileSectionA LoadLibraryA LocalAlloc MoveFileA SetProcessWorkingSetSize GetModuleFileNameA GetModuleHandleA FindFirstChangeNotificationA FreeEnvironmentStringsW GetConsoleTitleW VirtualProtect GetFileAttributesExW SetCalendarInfoA GetConsoleAliasesLengthW WriteConsoleOutputCharacterA UnregisterWait SetStdHandle CloseHandle GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess GetCurrentProcess HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent EnterCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetProcAddress GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer HeapSize CreateFileW

gdi32

GetTextExtentExPointA

winhttp

WinHttpCloseHandle

Name

.text

Size

695KB

Virtual Size

694KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.woza

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zan

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fecir

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.medi

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

buildp.exe

kernel32

gdi32

winhttp