mshta[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mshta.exe
Size

49KB
MD5

dbd36452fde8454baf6f7f6caa9dddcb
SHA1

37ce7cdcb3476fb16f0709c349c778e13385889a
SHA256

c3e423fea883d57a9e4f6d7376b58f7e30b23f8c30ca10a76253ff6bc38d7503
SHA512

aadf0869073e0f3396857125546f2210c0cd77cfc8fe7ef532ce590992170a9a0e48ada49df75ff5cf7e99e6e8d93278749f76a47362058f417a262bd4bfce49
SSDEEP

768:YFM+D7UBi9esx39Eaviez8CO8n7rP1U1ZV7RAOOVu4l2CuDaNqFNQMZC6kyRE5Kc:UdwKuiiiq1Z/bOPfNqYMZVkyR0Kc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mshta.exe

Files

mshta.exe
.exe windows x64

482d661acb78b36340af7beb797951ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_purecall
memmove_s
memcpy_s
_cexit
_vsnwprintf
memcmp
memset

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
Sleep
CreateSemaphoreExW
LeaveCriticalSection
CreateMutexExW
GetCurrentProcessId
MultiByteToWideChar
GetSystemTimeAsFileTime
LoadLibraryA
ExpandEnvironmentStringsA
GetTickCount
GetStartupInfoW
FreeLibrary
LoadLibraryW
GetVersion
CreateThreadpoolTimer
FormatMessageW
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetModuleHandleW
GetProcAddress
GetLastError
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenSemaphoreW
CloseHandle
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
SetLastError

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

482d661acb78b36340af7beb797951ee

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 84B

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 84B