keyhunt[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

keyhunt.exe
Size

542KB
MD5

b40e972d4b58f321fd77296014479a81
SHA1

0cf59ec89281974734b5b8faa9b0dc918b05dadd
SHA256

bd5ab30925cd864c3a318856aaa3c2221924a2a7f886abfb27edfa4a17b2b9f3
SHA512

8f9efab8ca96ef2288de1795dcb91731c2d11deddbfc8b90da9bae1748ee41be464572cec80d1c046c540f8bea0541f6624195a20bef819ebff20938d776638c
SSDEEP

12288:75j4x5OVFdlMBBi8H3vxk7n7sTUr+y4vDFdVr:7t4LOVFdC5SP8Ur+yUFdVr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
keyhunt.exe

Files

keyhunt.exe
.exe windows x64

4ad96dd5cb9675d9ef9a61d710db26d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

cygwin1

__assert_func
__cxa_atexit
__getreent
__main
__wrap__Znwm
_dll_crt0
_impure_ptr
calloc
ceil
clock
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
exit
fclose
feof
fflush
fgets
fopen
fprintf
fread
free
fseek
fwrite
getopt
log
logl
malloc
memcmp
memcpy
memmove
memset
nanosleep
optarg
posix_memalign
printf
pthread_create
pthread_detach
pthread_exit
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
putchar
puts
rand
realloc
snprintf
sprintf
srand
sscanf
stpcpy
strcat
strchr
strcmp
strlen
strncmp
strncpy
strspn
strtok
strtol
time
toupper

cyggcc_s-seh-1

_Unwind_Resume

cygstdc++-6

_ZNSs4_Rep10_M_destroyERKSaIcE
_ZNSs4_Rep20_S_empty_rep_storageE
_ZNSs4_Rep9_S_createEmmRKSaIcE
_ZNSsD1Ev
_ZSt17__throw_bad_allocv
_ZSt20__throw_length_errorPKc
_ZSt28__throw_bad_array_new_lengthv
_ZdlPvm
_Znwm
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_seh0

kernel32

GetModuleHandleA

Sections

.text
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 1024B - Virtual size: 690B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ad96dd5cb9675d9ef9a61d710db26d6

Headers

DLL Characteristics

File Characteristics

Imports

cygwin1

cyggcc_s-seh-1

cygstdc++-6

kernel32

Sections

.text Size: 400KB - Virtual size: 399KB

.data Size: 1024B - Virtual size: 544B

.rdata Size: 15KB - Virtual size: 14KB

.buildid Size: 512B - Virtual size: 53B

.pdata Size: 5KB - Virtual size: 4KB

.xdata Size: 6KB - Virtual size: 6KB

.bss Size: - Virtual size: 10KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 112B

/4 Size: 1024B - Virtual size: 608B

/19 Size: 27KB - Virtual size: 27KB

/31 Size: 3KB - Virtual size: 3KB

/45 Size: 2KB - Virtual size: 2KB

/57 Size: 1024B - Virtual size: 760B

/70 Size: 512B - Virtual size: 204B

/81 Size: 6KB - Virtual size: 5KB

/97 Size: 1024B - Virtual size: 690B

.text
Size: 400KB - Virtual size: 399KB

.data
Size: 1024B - Virtual size: 544B

.rdata
Size: 15KB - Virtual size: 14KB

.buildid
Size: 512B - Virtual size: 53B

.pdata
Size: 5KB - Virtual size: 4KB

.xdata
Size: 6KB - Virtual size: 6KB

.bss
Size: - Virtual size: 10KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 112B

/4
Size: 1024B - Virtual size: 608B

/19
Size: 27KB - Virtual size: 27KB

/31
Size: 3KB - Virtual size: 3KB

/45
Size: 2KB - Virtual size: 2KB

/57
Size: 1024B - Virtual size: 760B

/70
Size: 512B - Virtual size: 204B

/81
Size: 6KB - Virtual size: 5KB

/97
Size: 1024B - Virtual size: 690B