hh[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hh.exe
Size

15KB
MD5

050ab578e032a7c9ca722f632a4018ac
SHA1

143233a32d3b5fca1675f035510dd3623ba77bc7
SHA256

b4f3cd7dd365ca2757997ccc9907835ae659eb90ced73c4be6b78a159a8e5ad3
SHA512

20b291f025b1f55de13c55188860883a0ef0460d69050627a54f30e1104b2a7f48d72ff5f43b1beef3669697e6dcb436501a9a76cf5330a1abba52ddb61f66a6
SSDEEP

192:cVIgg8I3C/9VS0362DLgS/vBJE9s4WWkBGJ1KDJD/IWcUmCrt:cVIgP/+03xHgS/5syA1KDmWcUt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hh.exe

Files

hh.exe
.exe windows x86

99d13af39772c941fe737a6d21b77a26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

kernel32

ExpandEnvironmentStringsA
FreeLibrary
GetProcAddress
LoadLibraryA
SetProcessDEPPolicy
HeapSetInformation
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
UnhandledExceptionFilter
InterlockedExchange

msvcrt

__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__p__fmode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memset
_vsnprintf
__p__commode

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ