check_mk_agent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

check_mk_agent.exe
Size

1.9MB
MD5

1c8f238c8902f4c5ed8fd89865a92cff
SHA1

3a40085d43edfa6a50354c3da2edbc88cc45dfcf
SHA256

03672d48278530ccbcaf689c63a70a6150bb2e0075158c563d4844e773023798
SHA512

c2acb6aff85fbd80c1066b5349ce57226a9edd6a1eee78fa51b8c3766c87f2a30ab7eec7cd609aa08acfcaa4ec710b18eec5d89f973a7b3cd6f05706c1a663f3
SSDEEP

49152:AnvWG6cvlVIqjmkOaleAE8iz8Xnou401sF:ZHqjmkOatu

Score

N/A

Malware Config

Signatures

Files

check_mk_agent.exe
.exe windows x64

5f0baf1e74494871881a3722d062b903

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CloseEventLog
CloseServiceHandle
ControlService
CreateServiceA
CryptAcquireContextA
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptDuplicateHash
CryptEncrypt
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetHashParam
CryptGetKeyParam
CryptHashData
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
DeleteService
EnumServicesStatusExW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
GetTokenInformation
InitializeSecurityDescriptor
LookupAccountSidW
OpenEventLogW
OpenProcessToken
OpenSCManagerA
OpenServiceA
OpenServiceW
QueryServiceConfigW
QueryServiceStatus
ReadEventLogW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegisterServiceCtrlHandlerA
SetSecurityDescriptorDacl
SetServiceStatus
StartServiceCtrlDispatcherA

imagehlp

SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetOptions
SymInitialize
SymSetOptions

kernel32

AddVectoredExceptionHandler
AssignProcessToJobObject
CloseHandle
CompareFileTime
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateJobObjectA
CreatePipe
CreateProcessA
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileExA
FindFirstFileW
FindFirstVolumeMountPointA
FindFirstVolumeW
FindNextFileA
FindNextVolumeMountPointA
FindNextVolumeW
FindVolumeClose
FindVolumeMountPointClose
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDriveTypeA
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetHandleInformation
GetLastError
GetLogicalDriveStringsA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetStartupInfoA
GetSystemInfo
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVolumeInformationA
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MoveFileA
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PeekNamedPipe
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SearchPathA
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateJobObject
TerminateProcess
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrlenA

msvcrt

__C_specific_handler
___lc_codepage_func
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_close
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_findclose
_fmode
_fstat64
fwprintf
_get_osfhandle
_initterm
_localtime64
_lock
_lseeki64
_mbsicmp
_mktime64
_onexit
_setjmp
_stat64
_strnicmp
_telli64
_time64
_ultoa
_unlock
_vsnprintf
_wchdir
_wchmod
_wfindfirst64
_wfindnext64
_wfullpath
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wremove
_wrename
_write
_wstat64
_wutime64
abort
atoi
calloc
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fputwc
fread
free
fsetpos
fwprintf
fwrite
getc
getenv
getwc
isalnum
isdigit
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
putwc
raise
realloc
remove
rename
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtok
strtol
strtoul
strxfrm
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcscat
wcscoll
wcscpy
wcsftime
wcslen
wcstol
wcsxfrm
_snwprintf
longjmp
_write
_strdup
_read
_fileno
_fdopen
_close

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
GetErrorInfo

oleaut32

SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
VariantClear

shell32

CommandLineToArgvW

shlwapi

PathCombineA

user32

MessageBoxW

ws2_32

WSAAddressToStringA
WSCEnumProtocols

wsock32

WSACleanup
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostname
getpeername
htons
listen
ntohs
select
send
setsockopt
socket

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5f0baf1e74494871881a3722d062b903

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

imagehlp

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

user32

ws2_32

wsock32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.data Size: 16KB - Virtual size: 15KB

.rdata Size: 123KB - Virtual size: 123KB

.pdata Size: 70KB - Virtual size: 70KB

.xdata Size: 125KB - Virtual size: 124KB

.bss Size: - Virtual size: 6KB

.idata Size: 13KB - Virtual size: 12KB

.CRT Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 104B

.rsrc Size: 14KB - Virtual size: 13KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 16KB - Virtual size: 15KB

.rdata
Size: 123KB - Virtual size: 123KB

.pdata
Size: 70KB - Virtual size: 70KB

.xdata
Size: 125KB - Virtual size: 124KB

.bss
Size: - Virtual size: 6KB

.idata
Size: 13KB - Virtual size: 12KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 14KB - Virtual size: 13KB