wintty[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wintty.exe
Size

20KB
MD5

0be2e71af24bc50d95c9cae17814f5b5
SHA1

d05a7c180644e22ac540a7bf32288989ae744a88
SHA256

da4575852d2f09c50eafed55dd8123a098122a99964bd64f549fcee86ac7289a
SHA512

3b51bf83459ab74397ba7fffbc5c2765910b284c0454b52182871038c5d9f0f1a89a64abf0549504203f3e567ee5a0ffff30aff3787243c8a1f3e1be83a8544f
SSDEEP

192:Qw2V0I5kXVBOPErS+q8HNoyn1UAy2eG16JWOqfdN:QR5kyPErS+q8tnL/KJfqfdN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wintty.exe

Files

wintty.exe
.exe windows x86

51b858c1c66242fa3ab5cb732fb7bdaf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetConsoleTitleA
WriteFile
ReadFile
CreateThread
GetConsoleMode
SetConsoleMode
CreateFileA
SetConsoleTitleA
AllocConsole
GetExitCodeProcess
WaitForSingleObject
ResumeThread
CreateProcessA
GetModuleFileNameA
GetCommandLineA
FreeConsole
CloseHandle
DuplicateHandle
GetStdHandle
SetLastError
GetLastError
GetCurrentProcess

user32

GetProcessWindowStation
GetUserObjectInformationA
wvsprintfA

msvcrt

_strnicmp
_controlfp
_iob
exit
printf
atoi
tolower
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ