reader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

reader.exe
Size

1.2MB
MD5

f266ccc7fbf6991e2b92770c38af4e00
SHA1

40e5538084cd76df58030f1887d7507c1a2617f1
SHA256

94c69558f93678867a8d94d2581d5ec04225c9ad4bbf53cc8b710a40b43aec03
SHA512

e98449b60df77a6b38a6d3dd5641516f437620d2139b9f87c8e8fdb27ce82136ae70e8513f8ff05838852b7097fb609efc945696503b90ca9b92f72cba9228b7
SSDEEP

24576:J16y5hPT4Sf5H/wRnUW5YH3kt7Qn652xOjsI:J16yjL4S5/w1GH3kEvnI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
reader.exe

Files

reader.exe
.exe windows x64

1c26f1bba61385f1228692852d421e9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
GetCurrentThreadId
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
CreateFileW
GetFullPathNameW
FindFirstFileW
FindClose
GetFileInformationByHandle
WakeAllConditionVariable
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
CreateIoCompletionPort
InitializeSListHead
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetModuleFileNameW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
ReleaseSRWLockShared
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
RtlVirtualUnwind
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
RtlCaptureContext
SleepConditionVariableSRW
WakeConditionVariable
PostQueuedCompletionStatus
AcquireSRWLockShared
GetQueuedCompletionStatusEx
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
IsDebuggerPresent
SetHandleInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileInformationByHandleEx
SwitchToThread
AcquireSRWLockExclusive
HeapReAlloc
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
CloseHandle
DeleteFileW
Sleep
WriteConsoleW
HeapFree
IsProcessorFeaturePresent

ws2_32

shutdown
WSASocketW
getsockopt
WSASend
send
bind
setsockopt
getaddrinfo
closesocket
freeaddrinfo
WSAStartup
WSACleanup
WSAIoctl
getpeername
recv
connect
getsockname
WSAGetLastError
ioctlsocket

ntdll

NtDeviceIoControlFile
NtCreateFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtWriteFile

crypt32

CertVerifyCertificateChainPolicy
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateStore
CertCloseStore
CertDuplicateCertificateContext

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleA
DecryptMessage
ApplyControlToken

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

bcrypt

BCryptGenRandom

vcruntime140

memmove
memset
__current_exception_context
__current_exception
__C_specific_handler
memcmp
__CxxFrameHandler3
memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
_get_initial_narrow_environment
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_exit
_initialize_narrow_environment
_configure_narrow_argv
exit
_initterm
_c_exit
_initterm_e
_set_app_type
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 758KB - Virtual size: 757KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c26f1bba61385f1228692852d421e9b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

ntdll

crypt32

secur32

advapi32

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 758KB - Virtual size: 757KB

.rdata Size: 396KB - Virtual size: 396KB

.data Size: 512B - Virtual size: 760B

.pdata Size: 21KB - Virtual size: 21KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 758KB - Virtual size: 757KB

.rdata
Size: 396KB - Virtual size: 396KB

.data
Size: 512B - Virtual size: 760B

.pdata
Size: 21KB - Virtual size: 21KB

.reloc
Size: 5KB - Virtual size: 5KB