task[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

task.exe
Size

5.9MB
MD5

d796547b0e663e7e72c7a964762c69ec
SHA1

8c529aba050bf19024d0f951234c04491e81f872
SHA256

beb9445cf79c5b93b540ebf226abdb71a5cc7741e132e5d457a4b78c2b592667
SHA512

c9b74e099a1d7a8e2190d8105b0e63f12560e73a4bf081d16beca69f7d491e49d1bd05a217c0ce518b62e0c7b1fb89d0d975a405cfbd312fb1dad83f200d8c92
SSDEEP

98304:2dbDJSbIbxA3w2slHEzE37mIswW3s2v3CCQzkKim9YTBp:2dZ8w2s1EzI1G3xQdYTBp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
task.exe

Files

task.exe
.exe windows x86

57cd0781c9ba172079773f190301d6b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
LoadLibraryW
SetCurrentDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
CreateProcessW
GetSystemDefaultLangID
GetVersionExW
GetCurrentProcess
FreeLibrary
GetProcAddress
CreateThread
GetProcessHeap
SetEndOfFile
LCMapStringW
SetErrorMode
GetStringTypeW
FlushFileBuffers
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
Sleep
HeapCreate
SetStdHandle
WriteConsoleW
RaiseException
_lcreat
GlobalLock
GlobalUnlock
CreateDirectoryW
GetLastError
WideCharToMultiByte
GlobalAlloc
GlobalFree
GetTempPathW
MultiByteToWideChar
CloseHandle
CreateFileW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
FindNextFileW
FindClose
HeapReAlloc
ExitProcess
DecodePointer
WriteFile
GetConsoleCP
GetConsoleMode
HeapFree
HeapAlloc
ReadFile
SetFilePointer
DeleteFileA
GetFileAttributesW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
IsProcessorFeaturePresent
SetHandleCount
GetFileType
RtlUnwind

user32

GetMessageW
DestroyWindow
TranslateMessage
DispatchMessageW
LoadCursorW
RegisterClassW
PostThreadMessageW
DefWindowProcW
PostQuitMessage
BeginPaint
EndPaint
GetWindowLongW
GetDC
InvalidateRect
ReleaseDC
AdjustWindowRectEx
GetDesktopWindow
GetWindowRect
CreateWindowExW
SetWindowLongW
ShowWindow
UpdateWindow
LoadImageW
ExitWindowsEx
LoadStringW
MessageBoxW

gdi32

CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
SelectPalette
UnrealizeObject
RealizePalette
CreatePalette
GetObjectW
DeleteObject

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
RegOpenKeyExW
RegQueryValueW
RegCloseKey

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57cd0781c9ba172079773f190301d6b7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 291KB - Virtual size: 290KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 291KB - Virtual size: 290KB

.reloc
Size: 6KB - Virtual size: 5KB