tamfind[.]exe | Triage

General

Target

tamfind.exe
Size

484KB
MD5

47a20a2c2f9a39f5d64b1b0b06c3e57b
SHA1

764daa5b285e75a7fb0f17f58fff151a2b410590
SHA256

78a2e12459ba30b7732b691fe4e1c7bd7bbbedfde5a17c8b99f5b7f25ed62dde
SHA512

cf177811811939571f67de3f74817a537ba3710ea8de5fbf54705cecdd999f29b1414438350861fbd907e5b96cf759b2163f4968edc0ae545ce88731a677289b
SSDEEP

12288:chZ/Z2YDbeGpr5opNVIhDj02nI1xQ7TtmV:U/Z2aZopNVIhH02IrQ7Ta

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tamfind.exe

Files

tamfind.exe
.exe windows x86

c4ca4fe49368c4ba7e67b1512a858cfc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter
HeapAlloc
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
RaiseException
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetLastError
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetSystemTimeAsFileTime
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
GetCommandLineA
GetVersion
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
HeapFree
GlobalMemoryStatus
GetEnvironmentStrings
FreeEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
ReadFile
CloseHandle
SetFilePointer
WideCharToMultiByte
SetConsoleCtrlHandler
MultiByteToWideChar
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetFileAttributesA
SetEnvironmentVariableW
GetEnvironmentStringsW
SetStdHandle
GetStringTypeA
GetStringTypeW
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
CreateFileA
CompareStringA
CompareStringW
SetEndOfFile
GetFullPathNameA
GetDriveTypeA
SetFileAttributesA

user32

MessageBoxA

Sections

.text
Size: 380KB - Virtual size: 378KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4ca4fe49368c4ba7e67b1512a858cfc

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 380KB - Virtual size: 378KB

.rdata Size: 56KB - Virtual size: 52KB

.data Size: 20KB - Virtual size: 23KB

.idata Size: 4KB - Virtual size: 2KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 380KB - Virtual size: 378KB

.rdata
Size: 56KB - Virtual size: 52KB

.data
Size: 20KB - Virtual size: 23KB

.idata
Size: 4KB - Virtual size: 2KB

.reloc
Size: 20KB - Virtual size: 18KB