findstr[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

findstr.exe
Size

29KB
MD5

f1d4be0e99ec734376fde474a8d4ea3e
SHA1

d8b69c48d0b67d1825f191984e2032712823e4ec
SHA256

1900c48fdb1c2ddfa59c37ba86affa502d44af55f313d0d53fac60d9b96943b6
SHA512

4299d6599c48884a120277ca28b3ffa591b6180aee8da891a7ad85ddc316b01b8b67e29280cab684c1a4e84d964c0f98a58ab2c10779e17bc4a3485c7d56948d
SSDEEP

384:spHiw5XBWHg7B7FHn74cPQDRdExW4MkRfX0wbHu26BQtP3vMhfGGNYeCPXm0DnfM:Dw5XYAVpkBSREZuMwgYJm0jyqtVm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
findstr.exe

Files

findstr.exe
.exe windows x86

ad72e3c04c1bc40ab74532464b40a96e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strcoll
_exit
__set_app_type
exit
strcspn
isalpha
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
sprintf_s
strchr
_wsetlocale
_stricmp
_strlwr
_fileno
fgets
_except_handler4_common
isalnum
isxdigit
fprintf
_cexit
_isatty
_setmode
__p__fmode
__setusermatherr
tolower
free
_initterm
islower
memcpy
memmove
fclose
isupper
_strnicoll
fopen
clock
_ultoa
_itoa_s
malloc
_splitpath_s
_controlfp
strcat_s
?terminate@@YAXXZ
swprintf_s
__iob_func
_strncoll
strncpy_s
_strupr
strcpy_s
memset

ntdll

RtlMultiByteToUnicodeN
DbgPrint
RtlUnicodeToOemN

api-ms-win-core-file-l1-1-0

FindNextFileA
FindClose
WriteFile
CreateFileA
ReadFile
GetFileSize
FindFirstFileA
GetFileAttributesA

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleOutputCP

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryA
GetCurrentDirectoryA
GetStdHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages
IsDBCSLeadByte
FormatMessageA

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-file-l1-2-2

SetFileApisToOEM

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ExitProcess

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad72e3c04c1bc40ab74532464b40a96e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 35KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 35KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB