stop[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

stop.exe
Size

130KB
MD5

5c725d083f3929b5c523f6f068560669
SHA1

4b9f51c3cfa859456c4cce74442a4acd70cd7b55
SHA256

65f3162d46b247a9b79ace4c19e6ad81c5aa00a2229a6557f377f9ced697df01
SHA512

014b8a79c36fb1075a12edfad71e939d03822b7c3c9a5fb3a46cb39bfc92322e053997d39150b6503e3bb6c1817cb661493d8721e8011e5244867afbb1dac864
SSDEEP

1536:3zJc6F17L992+zfTmnsO4W1QpaonFGIkuwe31Q5LeI5xry0pvK/MlOWJryGOvaZ:CO7v2wfpHMmF31Q5nvrFRK/QXrjAw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

stop.exe

resource
stop.exe

Files

stop.exe
.exe windows x86

3f3196be03f57bb3aff9424932885030

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDefaultCommConfigW
HeapAlloc
GetConsoleAliasA
GetEnvironmentStringsW
SetConsoleScreenBufferSize
AddConsoleAliasW
SizeofResource
FindNextVolumeW
SetConsoleCursorPosition
WriteConsoleW
GetModuleFileNameW
LCMapStringA
SetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
GetFirmwareEnvironmentVariableW
GetAtomNameA
LoadLibraryA
LocalAlloc
GetModuleFileNameA
EraseTape
lstrcpyW
SetProcessAffinityMask
CreateFileW
ReadFile
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
GetModuleHandleW
ExitProcess
WriteFile
HeapCreate
Sleep
HeapSize
RtlUnwind
GetLastError
SetFilePointer
HeapFree
CloseHandle
FreeEnvironmentStringsW
WideCharToMultiByte
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
GetConsoleCP
GetConsoleMode
LoadLibraryW
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
SetStdHandle
FlushFileBuffers
MultiByteToWideChar
LCMapStringW
GetStringTypeW
SetEndOfFile
GetProcessHeap

user32

GetCursorPos

gdi32

GetCharWidth32A

advapi32

CloseEventLog

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gudo
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f3196be03f57bb3aff9424932885030

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Sections

.text Size: 77KB - Virtual size: 76KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 6KB - Virtual size: 36KB

.gudo Size: 1024B - Virtual size: 626B

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 77KB - Virtual size: 76KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 6KB - Virtual size: 36KB

.gudo
Size: 1024B - Virtual size: 626B

.rsrc
Size: 26KB - Virtual size: 26KB