crypt[.]bat | Triage

Sharing

General

Target

crypt.bat
Size

40KB
MD5

9b98dd1278a13e814dcdcdb083b06990
SHA1

56ed05de01f2719f6884d12f26962447ee5b0a0d
SHA256

04b8660c6cb40a6ec024cb28e6422eecf565e66604fc6a20854bd5f166c796d0
SHA512

9b95da933b31faee63f717a83d037a9589998fa7efa1f86bfd2938731934b4cc83f785b4d45e09826de44b0ba05b31f682f4037b833f3c1aaee02ff367c2bb56
SSDEEP

384:wnJ64e5olnqo66PD++6cNg2ORRSb9Jjw7O0ldR7yKPlyATugEPRcDv:dS66PDP6c2VmLjw7O07R7PPllavRcD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crypt.bat

Files

crypt.bat
.exe windows x86

c9d7cf020c6e06403cc066918e8fff72

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
SetFilePointer
ReadFile
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
CloseHandle
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE