control[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

control.exe
Size

115KB
MD5

88ea810385f455c74306d71c4879c61c
SHA1

391ff1f690c0912c217b3cf625900d4f50128867
SHA256

4774a931c9d97828323c9e829917d82c27a05dab9fea6a0cef9ebba59942231f
SHA512

d816977f9b9b147050937df7663be074fd44aa6dbff608a0e673bc2739fc1a1dbee506668a252d0a3a0b7e430a9b084502a9e7f7d4bb5ee69621fefe861d5646
SSDEEP

1536:trl0+A4FF/P4yXBe/qzSpZ3r1q6QkjfkQUk8+k6kawM1x8Dkf8dani25imK:tyt43/g4B7Sp5+1k12b/Af885RK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
control.exe

Files

control.exe
.exe windows x64

7a8ec2645c24d85de8216d63022623c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegEnumValueW

kernel32

GetStartupInfoW
GetCommandLineW
lstrlenW
ExpandEnvironmentStringsW
HeapSetInformation
GetModuleHandleW

user32

AllowSetForegroundWindow

msvcrt

_acmdln
_exit
_cexit
_ismbblead
exit
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
__getmainargs
?terminate@@YAXXZ
_commode
_fmode
__setusermatherr
__set_app_type
_vsnwprintf
memset

shlwapi

StrTrimW
ord158
ord437

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc
CoUninitialize

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

shell32

ShellExecuteExW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a8ec2645c24d85de8216d63022623c0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 576B

.rsrc Size: 98KB - Virtual size: 98KB

.reloc Size: 512B - Virtual size: 116B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 576B

.rsrc
Size: 98KB - Virtual size: 98KB

.reloc
Size: 512B - Virtual size: 116B