psadmin[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

psadmin.exe
Size

1.2MB
MD5

9a07fd25f40d2c4b3b9dd089a085f70f
SHA1

c2e9a617b28e18d5cec63664c3c037cc88b9104e
SHA256

eb6ef2183d68af25f0fdbb6e54a2a809627dce6031e0f290057114978cd24afd
SHA512

9165942444f36990fd0597d531d8e7cee4469d7b8e383cce0203f2eb8106f875ac156d7ac98da6e0b6f20387288cb4c7344e8f1a3dbf32cec14755169c9542a9
SSDEEP

24576:JjzrVddcr1lFBAGBtO4edgngHXndzaVU7TYny90m9MbiY/iwe2+UZ:JDdcrbjAGBtO4edgg3uUnUy9p9MbiY/t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
psadmin.exe

Files

psadmin.exe
.exe windows x86

daabe9860ed55e514c3e6b9f95ec59c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTimeZoneInformation
GetSystemTime
GetLocalTime
TerminateProcess
GetACP
HeapReAlloc
HeapSize
ExitThread
GetFileType
SetStdHandle
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
FreeEnvironmentStringsA
CreateThread
FreeEnvironmentStringsW
HeapAlloc
LoadLibraryA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GetModuleHandleA
GetProcAddress
GlobalLock
HeapFree
RaiseException
GlobalUnlock
ExitProcess
GetCommandLineA
GetStartupInfoA
RtlUnwind
SetErrorMode
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFileAttributesA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileSize
WritePrivateProfileStringA
GlobalAlloc
lstrcmpA
GetCurrentThread
SetLastError
MulDiv
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetTempFileNameA
GetFileAttributesA
GetModuleFileNameA
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
GetLastError
GlobalFree
SuspendThread
SetThreadPriority
lstrcpynA
IsBadWritePtr
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileIntA
LocalFree
MultiByteToWideChar
InterlockedIncrement
lstrlenA
InterlockedDecrement
LCMapStringA
FreeLibrary
ResetEvent
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
LCMapStringW
GetStringTypeA
SetUnhandledExceptionFilter
VirtualAlloc
FindResourceA
ReleaseMutex
SetEvent
GetTickCount
Sleep
CreateEventA
CreateMutexA
CloseHandle
WaitForSingleObject
GetCurrentDirectoryA
WaitForMultipleObjects
GetProfileStringA
ResumeThread
CreateProcessA
LockResource
LoadResource
SizeofResource
DebugBreak

user32

TranslateAcceleratorA
TranslateMDISysAccel
DefMDIChildProcA
RedrawWindow
SetRectEmpty
DefFrameProcA
DrawMenuBar
LoadAcceleratorsA
SetCursor
GetDesktopWindow
DestroyMenu
LoadMenuA
SetMenu
ReuseDDElParam
ReleaseCapture
ValidateRect
TranslateMessage
UnpackDDElParam
CharUpperA
ClientToScreen
PtInRect
IsZoomed
SetParent
IsRectEmpty
AppendMenuA
DeleteMenu
GetSystemMenu
InflateRect
GetWindowDC
BeginPaint
EndPaint
GetMessageA
DrawTextA
GrayStringA
ShowOwnedPopups
GetClassNameA
TabbedTextOutA
LoadCursorA
GetSysColorBrush
GetDCEx
LockWindowUpdate
SetCapture
InvertRect
FillRect
InsertMenuA
GetMenuStringA
LoadIconA
SendDlgItemMessageA
MapWindowPoints
GetSysColor
PeekMessageA
DispatchMessageA
GetFocus
SetFocus
ScreenToClient
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
IsWindowVisible
GetDlgItemInt
MessageBoxA
IsChild
GetCapture
WinHelpA
ReleaseDC
BringWindowToTop
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
DrawIconEx
DestroyIcon
LoadImageA
KillTimer
SetTimer
InvalidateRect
SetRect
UpdateWindow
LoadBitmapA
PostQuitMessage
MessageBeep
wvsprintfA
GetCursorPos
WindowFromPoint
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetDlgItemInt
GetDC
wsprintfA
LoadStringA
GetClassInfoA
GetWindowRect
GetClientRect
SendMessageA
EnableWindow
GetParent
GetWindow
PostMessageA
GetTopWindow
AdjustWindowRectEx
ExcludeUpdateRgn
HideCaret
DrawFocusRect
ShowCaret
DefDlgProcA
GetCaretPos
UnregisterClassA
CharNextA
IsWindowUnicode

gdi32

CreateCompatibleDC
GetTextExtentPoint32A
GetClipBox
SetTextColor
SetBkColor
GetObjectA
PatBlt
CreateRectRgnIndirect
CreateBitmap
StretchDIBits
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateFontA
GetTextMetricsA
GetDeviceCaps
CreatePatternBrush
SetRectRgn
CombineRgn
CreateRectRgn
ExtTextOutA
CreateFontIndirectA
DPtoLP
SaveDC
RestoreDC
GetStockObject
SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
MoveToEx
LineTo
SetTextAlign
CreatePen
CreateSolidBrush
PtVisible
RectVisible
TextOutA
Escape
CreateDIBitmap
GetTextExtentPointA
BitBlt
GetCharWidthA
DeleteObject

comdlg32

GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyExA
RegSetValueA
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
GetFileSecurityA
SetFileSecurityA
RegOpenKeyA
RegCloseKey

shell32

DragQueryFileA
DragFinish
SHGetFileInfoA
ExtractIconA

comctl32

ord17
ImageList_Draw
ImageList_AddMasked
ImageList_LoadImageA
ImageList_Destroy
ImageList_Create

wsock32

ntohs
htons
ioctlsocket
closesocket
setsockopt
sendto
bind
socket
WSAStartup
WSACleanup
inet_ntoa
recvfrom

setupapi

SetupIterateCabinetA

Sections

.text
Size: 372KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

daabe9860ed55e514c3e6b9f95ec59c9

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

wsock32

setupapi

Sections

.text Size: 372KB - Virtual size: 368KB

.rdata Size: 76KB - Virtual size: 72KB

.data Size: 24KB - Virtual size: 38KB

.rsrc Size: 772KB - Virtual size: 772KB

.text
Size: 372KB - Virtual size: 368KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 24KB - Virtual size: 38KB

.rsrc
Size: 772KB - Virtual size: 772KB