c_for[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c_for.exe
Size

10.2MB
MD5

f9c29a6b8f91dc59a7e735f07c80029f
SHA1

5b043add8284e0957360b59ddbce013c356cabb0
SHA256

f73932de49e79d081b9486c7be7645fb85a313892e374e95fb53d68656835b33
SHA512

44ca9c3f050b593a29b455139046f798cffe56a37b07f16b96ceb1acb8c4627fef68e01d6c1ed595a4ec2df5adf532880146b270cec4cf17f545aa41b9ea0445
SSDEEP

98304:o3uo5bRwbYE/YQK+BK0tvsQ9pqSMh1aJuvA5oOS0cx:2usFuYQK+BK0tv8biK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c_for.exe

Files

c_for.exe
.exe windows x64

89bb3bb9de557fee0d4a80468e73499f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegGetValueW
RegOpenKeyExA

libgcc_s_seh-1

_Unwind_Resume
__emutls_get_address

kernel32

AddVectoredExceptionHandler
AssignProcessToJobObject
CloseHandle
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateHardLinkW
CreateJobObjectW
CreateProcessW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageA
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleW
GetLastError
GetLogicalProcessorInformationEx
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessAffinityMask
GetProcessGroupAffinity
GetProcessTimes
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetThreadGroupAffinity
GetThreadId
GetVolumePathNameW
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
RaiseException
ReadFile
RemoveVectoredExceptionHandler
ResumeThread
RtlCaptureContext
SearchPathW
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetCurrentDirectoryW
SetErrorMode
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
SetInformationJobObject
SetLastError
SetProcessAffinityMask
SetThreadGroupAffinity
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_beginthreadex
_cexit
_chsize
_commode
_close
_errno
_fileno
_fmode
_get_osfhandle
_heapwalk
_initterm
_localtime64
_lseeki64
_onexit
_open_osfhandle
_read
_set_error_mode
_setjmp
_setmode
_strtoi64
_strtoui64
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
free
fwrite
getenv
isalnum
isalpha
islower
isupper
isxdigit
localeconv
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
rand
realloc
signal
srand
strchr
strcmp
strerror
strftime
strlen
strncmp
tolower
toupper
vfprintf
wcslen

ole32

CoTaskMemFree

libwinpthread-1

pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_rwlock_rdlock
pthread_rwlock_unlock
pthread_rwlock_wrlock

shell32

SHFileOperationW
SHGetKnownFolderPath

libstdc++-6

_ZNKSt3_V214error_category10_M_messageB5cxx11Ei
_ZNKSt3_V214error_category10equivalentERKSt10error_codei
_ZNKSt3_V214error_category10equivalentEiRKSt15error_condition
_ZNKSt3_V214error_category23default_error_conditionEi
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE16find_last_not_ofEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7compareEPKc
_ZNKSt8__detail20_Prime_rehash_policy11_M_next_bktEy
_ZNKSt8__detail20_Prime_rehash_policy14_M_need_rehashEyyy
_ZNSaIcEC1ERKS_
_ZNSaIcEC1Ev
_ZNSaIcEC2ERKS_
_ZNSaIcED1Ev
_ZNSaIcED2Ev
_ZNSt3_V214error_categoryD2Ev
_ZNSt3_V215system_categoryEv
_ZNSt3_V216generic_categoryEv
_ZNSt6chrono3_V212steady_clock3nowEv
_ZNSt6chrono3_V212system_clock3nowEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE14_M_replace_auxEyyyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4swapERS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8_M_eraseEyy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_mutateEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9push_backEc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC2EPKcRKS3_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED2Ev
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEOS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLERKS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_replaceEyyPKwy
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6resizeEyw
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7reserveEy
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_createERyy
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_mutateEyyPKwy
_ZNSt8__detail15_List_node_base7_M_hookEPS0_
_ZNSt8__detail15_List_node_base9_M_unhookEv
_ZSt11_Hash_bytesPKvyy
_ZSt15set_new_handlerPFvvE
_ZSt17__throw_bad_allocv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt20__throw_system_errori
_ZSt24__throw_out_of_range_fmtPKcz
_ZSt25__throw_bad_function_callv
_ZSt28__throw_bad_array_new_lengthv
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt7nothrow
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdaPv
_ZdlPv
_ZdlPvy
_Znay
_Znwy
_ZnwyRKSt9nothrow_t
__cxa_begin_catch
__cxa_end_catch
__cxa_guard_acquire
__cxa_guard_release
__cxa_pure_virtual
__cxa_rethrow
__gxx_personality_seh0

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 936KB - Virtual size: 936KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89bb3bb9de557fee0d4a80468e73499f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

libgcc_s_seh-1

kernel32

msvcrt

ole32

libwinpthread-1

shell32

libstdc++-6

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.data Size: 1024B - Virtual size: 584B

.rdata Size: 936KB - Virtual size: 936KB

.pdata Size: 73KB - Virtual size: 73KB

.xdata Size: 96KB - Virtual size: 95KB

.bss Size: - Virtual size: 14KB

.idata Size: 12KB - Virtual size: 11KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 30KB - Virtual size: 29KB

/4 Size: 8KB - Virtual size: 8KB

/19 Size: 1.5MB - Virtual size: 1.5MB

/31 Size: 27KB - Virtual size: 26KB

/45 Size: 56KB - Virtual size: 56KB

/57 Size: 34KB - Virtual size: 33KB

/70 Size: 19KB - Virtual size: 19KB

/81 Size: 19KB - Virtual size: 18KB

/97 Size: 51KB - Virtual size: 51KB

/113 Size: 5KB - Virtual size: 5KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 1024B - Virtual size: 584B

.rdata
Size: 936KB - Virtual size: 936KB

.pdata
Size: 73KB - Virtual size: 73KB

.xdata
Size: 96KB - Virtual size: 95KB

.bss
Size: - Virtual size: 14KB

.idata
Size: 12KB - Virtual size: 11KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 29KB

/4
Size: 8KB - Virtual size: 8KB

/19
Size: 1.5MB - Virtual size: 1.5MB

/31
Size: 27KB - Virtual size: 26KB

/45
Size: 56KB - Virtual size: 56KB

/57
Size: 34KB - Virtual size: 33KB

/70
Size: 19KB - Virtual size: 19KB

/81
Size: 19KB - Virtual size: 18KB

/97
Size: 51KB - Virtual size: 51KB

/113
Size: 5KB - Virtual size: 5KB