gsar[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

gsar.exe
Size

20KB
MD5

fc1298a1122983e52633e86aa44a7878
SHA1

0af1e674b7d55d53b45c27511993f5569e40c796
SHA256

be320ab75b32c5a3bd05b9f27b02f53d80ff8d63676cacdae16ab6278e3760f7
SHA512

c3b300b130ae0632e381853ff867f700ef1d223b74c2f4ae622a32a6a57960df40753ce7c425b47ba9d17c1c6c4a5c8e06b49360f08917880fa3cc0af1829c36
SSDEEP

384:XaQ3Vxgv7o60S903ZwLw6se0Et0u93C3dLOVWCV87Buxh3Y:PVxgv7X0YJrth93C0O0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gsar.exe

Files

gsar.exe
.exe windows x86

5458e7b32d27823ecbd99649358b214c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
SetUnhandledExceptionFilter

msvcrt

_fileno
_isatty
_setmode
_stat
__getmainargs
__p__environ
__set_app_type
_cexit
_fileno
_fmode
_iob
_onexit
_setmode
abort
atexit
exit
fclose
fflush
fopen
fprintf
fputc
fputs
fread
free
fwrite
iscntrl
islower
isupper
malloc
memcpy
memset
realloc
remove
rename
setvbuf
signal
sprintf
strcat
strchr
strcpy
strlen
strtol
tolower
toupper
vfprintf

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE