met[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

met.exe
Size

1.2MB
MD5

a8558d6b6d80af8d991a468bb1b4b2b5
SHA1

f9416cb8e7535643f86c5a3540642fe0fb0b09d0
SHA256

16fbabbe3842fee9262fd42da0151f81e4375652d59b01f75a1f0dff46cda69f
SHA512

5e2938735a9d429acda33a2c4c30c07131df13ad62360db897bb178988471457cc0b2d4a046c31f6b6d1794331abd90112d5b9285b02956ba2479aaea181fc7f
SSDEEP

6144:4AFObyV0RWeTKO40HAOWZ4s+H1CCZnvYO6yq2u8erIUfc:VsbyGHTq0kZ3aNZnvYWJuv1fc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
met.exe

Files

met.exe
.exe windows x86

104b87c3fef9c18dcad72b41783c28ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindow
CharUpperA

shell32

ord6

kernel32

GetProcAddress
CreateFileW
HeapSize
ReadConsoleW
GetProcessHeap
GetModuleHandleW
GetConsoleWindow
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
SetStdHandle
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
WriteConsoleW
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetFileType
GetFileSizeEx
SetFilePointerEx
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 140KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.uranium
Size: 687KB - Virtual size: 687KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

104b87c3fef9c18dcad72b41783c28ec

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

kernel32

Sections

.text Size: 113KB - Virtual size: 113KB

.rdata Size: 51KB - Virtual size: 50KB

.data Size: 140KB - Virtual size: 143KB

.reloc Size: 7KB - Virtual size: 6KB

.uranium Size: 687KB - Virtual size: 687KB

.text
Size: 113KB - Virtual size: 113KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 140KB - Virtual size: 143KB

.reloc
Size: 7KB - Virtual size: 6KB

.uranium
Size: 687KB - Virtual size: 687KB