c_while[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

c_while.exe
Size

7.3MB
MD5

638ffa3197fc59fc11e30bf1a966b054
SHA1

4b5b3a7079299ade5a315b60f08809cc5f5a61df
SHA256

5fb4fd4d3d3223f94d424a83459d97bc86750576a0a943cf4324182b0fd67108
SHA512

06ad6478f4ff3b293d378b84efb4a4f03ca0839d564022c954a9242e2cea56aa58f72d2e5586edcc2fe7b2b5cf433314268017da232641c360a71cf9a100367a
SSDEEP

49152:mZArpSphRBt3fXQZQ6qJCyXTz7nwSAKx2v5QK+lOYJVAnGcYPQvvYbmANP3Q:midSBoQ64z7wQK+l/LyYPQvvYbmANP3Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c_while.exe

Files

c_while.exe
.exe windows x64

e6cf9729028a68cf114ded7ef5e47768

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegGetValueW
RegOpenKeyExA

libgcc_s_seh-1

_Unwind_Resume

kernel32

AddVectoredExceptionHandler
AssignProcessToJobObject
CloseHandle
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateHardLinkW
CreateJobObjectW
CreateProcessW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageA
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleW
GetLastError
GetLogicalProcessorInformationEx
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessAffinityMask
GetProcessGroupAffinity
GetProcessTimes
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetThreadGroupAffinity
GetThreadId
GetVolumePathNameW
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
RaiseException
ReadFile
RemoveVectoredExceptionHandler
ResumeThread
RtlCaptureContext
SearchPathW
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetCurrentDirectoryW
SetErrorMode
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
SetInformationJobObject
SetLastError
SetProcessAffinityMask
SetThreadGroupAffinity
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_beginthreadex
_cexit
_chsize
_commode
_close
_errno
_fileno
_fmode
_get_osfhandle
_heapwalk
_initterm
_lseeki64
_onexit
_open_osfhandle
_read
_set_error_mode
_setjmp
_setmode
_write
abort
calloc
exit
fflush
fprintf
fputc
free
fwrite
getenv
isalnum
isalpha
islower
isupper
localeconv
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
rand
realloc
signal
srand
strcmp
strerror
strlen
strncmp
tolower
toupper
vfprintf
wcslen

ole32

CoTaskMemFree

libwinpthread-1

pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock

shell32

SHFileOperationW
SHGetKnownFolderPath

libstdc++-6

_ZNKSt3_V214error_category10_M_messageB5cxx11Ei
_ZNKSt3_V214error_category10equivalentERKSt10error_codei
_ZNKSt3_V214error_category10equivalentEiRKSt15error_condition
_ZNKSt3_V214error_category23default_error_conditionEi
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE16find_last_not_ofEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7compareEPKc
_ZNSolsEPFRSoS_E
_ZNSt3_V214error_categoryD2Ev
_ZNSt3_V215system_categoryEv
_ZNSt3_V216generic_categoryEv
_ZNSt6chrono3_V212steady_clock3nowEv
_ZNSt6chrono3_V212system_clock3nowEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE14_M_replace_auxEyyyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8_M_eraseEyy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_mutateEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC2EPKcRKS3_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED2Ev
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEOS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLERKS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_replaceEyyPKwy
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6resizeEyw
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7reserveEy
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_createERyy
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_mutateEyyPKwy
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZSt15set_new_handlerPFvvE
_ZSt17__throw_bad_allocv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt20__throw_system_errori
_ZSt24__throw_out_of_range_fmtPKcz
_ZSt25__throw_bad_function_callv
_ZSt28__throw_bad_array_new_lengthv
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt4cout
_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
_ZSt7nothrow
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdaPv
_ZdlPv
_ZdlPvy
_Znay
_Znwy
_ZnwyRKSt9nothrow_t
__cxa_guard_acquire
__cxa_guard_release
__cxa_pure_virtual
__gxx_personality_seh0

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 882KB - Virtual size: 881KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1024B - Virtual size: 997B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6cf9729028a68cf114ded7ef5e47768

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

libgcc_s_seh-1

kernel32

msvcrt

ole32

libwinpthread-1

shell32

libstdc++-6

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.data Size: 512B - Virtual size: 404B

.rdata Size: 882KB - Virtual size: 881KB

.pdata Size: 58KB - Virtual size: 58KB

.xdata Size: 76KB - Virtual size: 75KB

.bss Size: - Virtual size: 10KB

.idata Size: 11KB - Virtual size: 11KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 28KB

/4 Size: 2KB - Virtual size: 2KB

/19 Size: 208KB - Virtual size: 207KB

/31 Size: 18KB - Virtual size: 18KB

/45 Size: 40KB - Virtual size: 39KB

/57 Size: 11KB - Virtual size: 10KB

/70 Size: 1024B - Virtual size: 997B

/81 Size: 15KB - Virtual size: 15KB

/97 Size: 50KB - Virtual size: 50KB

/113 Size: 2KB - Virtual size: 1KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 512B - Virtual size: 404B

.rdata
Size: 882KB - Virtual size: 881KB

.pdata
Size: 58KB - Virtual size: 58KB

.xdata
Size: 76KB - Virtual size: 75KB

.bss
Size: - Virtual size: 10KB

.idata
Size: 11KB - Virtual size: 11KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 28KB

/4
Size: 2KB - Virtual size: 2KB

/19
Size: 208KB - Virtual size: 207KB

/31
Size: 18KB - Virtual size: 18KB

/45
Size: 40KB - Virtual size: 39KB

/57
Size: 11KB - Virtual size: 10KB

/70
Size: 1024B - Virtual size: 997B

/81
Size: 15KB - Virtual size: 15KB

/97
Size: 50KB - Virtual size: 50KB

/113
Size: 2KB - Virtual size: 1KB