easy_Benign_ffa2fe79fb33dd6d1299859388f3e85684ec0f46cd05133c728629cdfba38b3a[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

easy_Benign_ffa2fe79fb33dd6d1299859388f3e85684ec0f46cd05133c728629cdfba38b3a.exe
Size

12KB
MD5

4315cf409966a7a729613c91a166c82e
SHA1

7f5f2f29472c8ce861a8cab3cd5d88c94059f301
SHA256

ffa2fe79fb33dd6d1299859388f3e85684ec0f46cd05133c728629cdfba38b3a
SHA512

41b4cd7193ec0ff5aa81d0bd0fb0a15a290bd14a9149c3179d78cf1f4c8c9b26651c7714aae703f376386462be93860dccdeb645f36184d52e320284cde380ee
SSDEEP

192:FcuS2W6XCFoTV9PaC6X/jOUpuKbF65eDlz3HmtWK58W:FcFfITVMX/jp9YSpWtWK58W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
easy_Benign_ffa2fe79fb33dd6d1299859388f3e85684ec0f46cd05133c728629cdfba38b3a.exe

Files

easy_Benign_ffa2fe79fb33dd6d1299859388f3e85684ec0f46cd05133c728629cdfba38b3a.exe
.exe windows x64

9bbe30c740e1be526af581ee06ba26d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__getmainargs

ulib

??0ARRAY@@QEAA@XZ
?Initialize@STREAM_MESSAGE@@QEAAEPEAVSTREAM@@00@Z
??1STREAM_MESSAGE@@UEAA@XZ
??0STREAM_MESSAGE@@QEAA@XZ
?Initialize@STRING_ARGUMENT@@QEAAEPEAD@Z
??1STRING_ARGUMENT@@UEAA@XZ
??0STRING_ARGUMENT@@QEAA@XZ
??1ARRAY@@UEAA@XZ
?QueryDriveType@SYSTEM@@SA?AW4DRIVE_TYPE@@PEBVWSTRING@@@Z
?QueryCurrentDosDriveName@SYSTEM@@SAEPEAVWSTRING@@@Z
??8WSTRING@@QEBAEAEBV0@@Z
?Strupr@WSTRING@@QEAAPEAV1@XZ
?Get_Standard_Output_Stream@@YAPEAVSTREAM@@XZ
??0FLAG_ARGUMENT@@QEAA@XZ
?Initialize@FLAG_ARGUMENT@@QEAAEPEAD@Z
?Initialize@ARRAY@@QEAAEKK@Z
?Strcat@WSTRING@@QEAAEPEBV1@@Z
?IsValueSet@ARGUMENT@@QEAAEXZ
?Initialize@WSTRING@@QEAAEPEBDK@Z
?Display@MESSAGE@@QEAAEPEBDZZ
?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
??0DSTRING@@QEAA@XZ
??1DSTRING@@UEAA@XZ
??1OBJECT@@UEAA@XZ
?Get_Standard_Input_Stream@@YAPEAVSTREAM@@XZ
??0ARGUMENT_LEXEMIZER@@QEAA@XZ
??1ARGUMENT_LEXEMIZER@@UEAA@XZ
?Initialize@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?QueryInvalidArgument@ARGUMENT_LEXEMIZER@@QEAAPEAVWSTRING@@XZ
?PrepareToParse@ARGUMENT_LEXEMIZER@@QEAAEPEAVWSTRING@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QEAAXE@Z
?Put@ARRAY@@UEAAEPEAVOBJECT@@@Z

ifsutil

?DosDriveNameToNtDriveName@IFS_SYSTEM@@SAEPEBVWSTRING@@PEAV2@@Z
?DiskCopyMainLoop@@YAHPEBVWSTRING@@000EPEAVMESSAGE@@1@Z

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

kernel32

GetCurrentProcess
TerminateProcess
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9bbe30c740e1be526af581ee06ba26d8

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ulib

ifsutil

ntdll

kernel32

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 168B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 72B

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 168B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 72B