agent_cr1[.]exe_ | Triage

Sharing

Copy URL Twitter E-mail

General

Target

agent_cr1.exe_
Size

4.2MB
MD5

747b9e5b4d641f8a2355681f0207aeb4
SHA1

f982a787c2384972c179eca9fc36d009f8eb9665
SHA256

b5f02c7f35765c2517f5ef4aefcae33b66aa3b6346e1121b5c39bf1a9e0a05db
SHA512

81dbbb8a24b13b74fbabb7e8ae6b75bdf5904671d4c61a5357e0371df9f5d741229cc71387c005d5ea9c94e5107b9e7027773075523db2e66c57feb59dccfa54
SSDEEP

98304:Labs/LfTgFpoCjL/84uvPH7jbRenVT0qToVRR255SVoHktTT1HaHA6Hr0nw:LrbSxHYnHbooHm5SOHeTZHajL0nw

Score

1^/10

Malware Config

Signatures

Files

agent_cr1.exe_
.exe windows x64

3f18007bca7df68175ef48581cb6c098

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetStdHandle
GetCommandLineA
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateFileA
GetFileAttributesA
GetFileSize
LockFile
CloseHandle
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetCurrentThread
GetCurrentThreadId
VirtualAlloc
GetProcAddress
SwitchToFiber
DeleteFiber
CreateFiber
WaitForMultipleObjects
LoadLibraryA
CallNamedPipeA
CreateActCtxA
ActivateActCtx
GetCurrentActCtx

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ