helloc[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

helloc.exe
Size

23KB
MD5

a4affe82278964398c804eb9b8111f0b
SHA1

72e1f9b0839979ef82902be2e4a086fc8c046465
SHA256

1d77939f7e184452d9eeb695b2fa41e3782bb7c365601a35e48d6f8a67c8236c
SHA512

703fb08783b941fa57282b19f9a394fd84f4dc85ad1e93b10395442ec68311271caf661773438023e4cf08a70d2b768eb7c1da2ed06ecc03d8be88140ed358b5
SSDEEP

384:HS9sa8J11yoj2ceTTw90duBg5ksdvI/WNfH6FNlYSmrH+pZsGbQ:Hbf19js0muBg+Xel6FNlxiH+pGUQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
helloc.exe

Files

helloc.exe
.exe windows x64

2c4ed0763cd0b6b19bc754db6adc428f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

rpcrt4

RpcStringFreeA
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcBindingSetAuthInfoExA
NdrClientCall2
RpcBindingFree

ntdsapi

DsWriteAccountSpnA
DsGetSpnA
DsUnBindA
DsBindA

secur32

GetComputerObjectNameA

netapi32

DsGetDcNameA
NetApiBufferFree

kernel32

GetModuleHandleW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoW
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
RtlCaptureContext
GetLastError

vcruntime140d

__C_specific_handler
__current_exception
__current_exception_context
__std_type_info_destroy_list

ucrtbased

_exit
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_seh_filter_dll
__setusermatherr
_initterm
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_set_app_type
__stdio_common_vfprintf
puts
__acrt_iob_func
exit
malloc
free
tolower
_initterm_e
__stdio_common_vfprintf_s
_initialize_narrow_environment
_register_onexit_function
_configure_narrow_argv
_initialize_onexit_table
_seh_filter_exe
_get_initial_narrow_environment

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c4ed0763cd0b6b19bc754db6adc428f

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

ntdsapi

secur32

netapi32

kernel32

vcruntime140d

ucrtbased

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 1KB - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 1KB - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 68B