icsu[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

icsu.exe
Size

161KB
MD5

6cd2df769b23201a6e5ca0e4bbdbb59b
SHA1

359b1926d9cb5063f66c3d191532de4f688b32af
SHA256

2aa5cc0e3a67d2aaa080ff0e22893f3478e467e983d6e99017a16ae09992d5c0
SHA512

24a5cdd30190e7a0d12e7067175082667639b489c241abcac06f284587fd7cf850d39235eb9ea16d43545b420d586e8875b6e8eb947bd25cf06d778ecf30b385
SSDEEP

3072:lSH5teUV07aedNqBcIjQCCVw/LQZsin01RdDBQcbiBginj8V3K12LB:YHreUV0ueX2/mVw/Lal01RJOcbijMd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
icsu.exe

Files

icsu.exe
.exe windows x86

ca74bd1146367878ede563b03da55c5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

setsockopt
WSACleanup
__WSAFDIsSet
closesocket
gethostbyname
select
ntohl
shutdown
WSAStartup
send
socket
connect
recv
htonl
htons
ioctlsocket
WSAGetLastError

kernel32

EnterCriticalSection
DecodePointer
HeapSize
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
GetModuleFileNameW
FindClose
CreateFileW
GetFileAttributesW
GetLogicalDriveStringsW
Sleep
FileTimeToSystemTime
DeleteFileW
CloseHandle
SetFilePointerEx
FormatMessageW
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RemoveDirectoryW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca74bd1146367878ede563b03da55c5e

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

Sections

.text Size: 119KB - Virtual size: 118KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 2KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 119KB - Virtual size: 118KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 6KB - Virtual size: 5KB