chgport[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

chgport.exe
Size

24KB
MD5

7ff1e566408bb6aa60401dfb0a8ccab9
SHA1

21dd46155de91b6196f0add2bb90bacf6dd51891
SHA256

92e224a1e945b43143d74d1396b391c0fe9e123fd075c8ff368a7800b1fcd985
SHA512

3fa30ce26d3fbd2bf97efd27d5a4953a90fbe8cee455314f53f011b139612837080f527d0133ee4179e09692eacbbf210d24e746836033d0a88291c089d13859
SSDEEP

768:9r+otF1NLLreAtASiVnK8NV+HMAjMujy:cYPr8SykHjXy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chgport.exe

Files

chgport.exe
.exe windows x64

f3a2024f3062fc17b3aab1815be21c38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumValueW
RegOpenKeyExW

user32

LoadStringW
CharToOemW

kernel32

RtlCaptureContext
Sleep
TerminateProcess
QueryDosDeviceW
SetLastError
GetConsoleOutputCP
SetThreadUILanguage
GetLastError
DefineDosDeviceW
HeapSetInformation
GetStdHandle
MultiByteToWideChar
FormatMessageW
LoadLibraryW
WriteConsoleW
RtlLookupFunctionEntry
FreeLibrary
GetFileType
GetCommandLineW
LocalAlloc
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetOEMCP
GetACP
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
GetCurrentProcess
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW

ntdll

NtOpenFile
NtQueryVolumeInformationFile
NtClose
RtlInitUnicodeString

msvcrt

free
iswalnum
_wsetlocale
_wcsnicmp
wcsrchr
malloc
_ultoa
wcscat_s
vswprintf_s
vfwprintf
fwprintf
wcstol
wprintf
swprintf_s
wcstoul
_wcsdup
_wcslwr
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
wcscpy_s
_wcsicmp
setlocale
memmove
wcschr
memcpy
printf
__iob_func
memset

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3a2024f3062fc17b3aab1815be21c38

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-registry-l1-1-0

user32

kernel32

ntdll

msvcrt

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 6KB

.pdata Size: 1024B - Virtual size: 588B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 60B

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 6KB

.pdata
Size: 1024B - Virtual size: 588B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 60B