choice[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

choice.exe
Size

29KB
MD5

11ddfbf834bb2c6f4d23297d80ee9e45
SHA1

1639efd0f31c3f08a26559663bad02029a1a9136
SHA256

4108605207ef00fcbbfe7ed7c3f96300601fb79f913d0e290538e8e02082cacc
SHA512

745fe9bf56212cb956ea6984d7973da5e04926b15109b7010b8291688e621386ad8f9908e47f8df27bcaf111c0dbef0f2c0805e574b89993945f65082ed3b7e5
SSDEEP

768:0sYto5sypZPoDxC3Do12N5JFskann+rztq:ctahpZ6xDAJSTnszt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
choice.exe

Files

choice.exe
.exe windows x86

5eea6fecc550e2786b6e075a5e47f5d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
GetLastError
ReadFile
Beep
ReadConsoleW
PeekConsoleInputW
WaitForSingleObject
GetTickCount
SetConsoleCtrlHandler
FlushConsoleInputBuffer
SetConsoleMode
GetConsoleMode
GetStdHandle
HeapSetInformation
GetModuleFileNameW
WriteConsoleW
ExitProcess
GetConsoleOutputCP
HeapReAlloc
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapValidate
WideCharToMultiByte
MultiByteToWideChar
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
GetFileType
VerSetConditionMask
VerifyVersionInfoW
FormatMessageW
LocalFree
SetThreadUILanguage
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
InterlockedCompareExchange
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
Sleep

msvcrt

_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__wgetmainargs
memset
_errno
wcstol
exit
wcschr
__iob_func
_vsnwprintf
_memicmp
_get_osfhandle
_fileno
fflush
fprintf
wcstod
wcstoul

user32

CharNextW
CharUpperW
CharUpperBuffW
LoadStringW

ws2_32

WSACleanup

shlwapi

StrChrW
StrChrIW
StrStrW
StrStrIW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5eea6fecc550e2786b6e075a5e47f5d0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

ws2_32

shlwapi

version

Sections

.text Size: 24KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB