ctfmon[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ctfmon.exe
Size

9KB
MD5

1b19d302d7ffa3d0901b3d990a4e8e12
SHA1

1c06dbe26185e2956373118edc7543ee5fe9b6eb
SHA256

33ad4738b6342c9cc2da01402b26a4424c0adfddde9936d8926a86bf8d80d44f
SHA512

348405010f1af06ade0f4b9a27144e783c48777e93d0efd2d2f42c3dbac34dd9ca54ec7618120384f36b1a34bc0bcc0a38808080b8d6866c010743e327890293
SSDEEP

96:K6Qq4eRAWEKAp2hJH3DGjoK6HU9osQshDJ7pRKRcLEWhgWwUeq:K6Qq4q2JUU9osQsniWhgW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ctfmon.exe

Files

ctfmon.exe
.exe windows x86

a0df2cae30cd48f978a8d80039c738e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapSetInformation
GetStartupInfoW
WerSetFlags
GetCommandLineW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep

msvcrt

_acmdln
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_except_handler4_common

msctfmonitor

DoMsCtfMonitor

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 970B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ