a[.]exe | Triage

Sharing

General

Target

a.exe
Size

20KB
MD5

104d16826db9b10ed83dd119e410b9f5
SHA1

f8f0468abaf481ab9590e7dd65f8c2ca3baf2aea
SHA256

9a097103785ddea1e9db97c2ac74347997913e705b0564be870c44704c36b604
SHA512

995babfb10713a422ba21fb009c394eb08ec06ca4394923d3efce37b3ca6fa18ef54563a17c2a503df12fbe8332bfb4b1808ba652b0e893556a4499898faab81
SSDEEP

384:k9yU45ePGEE79HjpGLfbSPbMXDOZ+J8gNRmfn:k9BVEJD0LfbtDJJ8Ekn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a.exe

Files

a.exe
.exe windows x64

8550b9122a4d909a8607237e7d2f9bac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlReleaseRelativeName
NtClose
RtlFreeHeap
NtCreateFile
NtMapViewOfSection
RtlWriteRegistryValue
NtQuerySystemInformation
NtUnloadDriver
NtCreateSection
_snwprintf
RtlInitUnicodeString
wcscpy_s
wcscat_s
RtlGetFullPathName_UEx
NtDeviceIoControlFile
RtlAdjustPrivilege
_stricmp
NtUnmapViewOfSection
NtLoadDriver
memcmp
NtTerminateProcess
RtlNormalizeProcessParams
RtlAllocateHeap
RtlCreateRegistryKey
_vsnwprintf
strcmp

kernel32

ReadConsoleInputW
WriteConsoleW

shlwapi

SHDeleteKeyW

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ