Pd0x[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Pd0x.exe
Size

1.0MB
MD5

c995df28cb464b7e3c9125b68782393e
SHA1

0b920173d6f3502384a5f158aa9318c9765153e4
SHA256

8425022cdb78c033ccf0225f4792ab4a07fd8ef21f51cc4e0c420853c4b29ca1
SHA512

6771b99e9bc4a87b43b4d764221ba79b4d390af050a170d1af4e982c6f22eaf25b5c26dcf41b6e9a1bda4acb4cace93b7757e8920543db222a6536ad32f7a9c1
SSDEEP

12288:e0tn6BuPqJOEG/a0kfPTUHDvphrXnXrXFppdhQyB5sHH0:ocqJOEVjfPTUFhrXnXrXFLdhDy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Pd0x.exe

Files

Pd0x.exe
.exe windows x64

3f40a7690d75d7380b3b21231c6b57d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

memmove
memset
memcpy
__iob_func
fprintf
exit
strerror
strlen
fflush
fwrite
_get_osfhandle
atexit
setbuf
memcmp
qsort
wcslen
_wgetenv
_putenv
_close
_write
_read
_wopen
_errno
_fdopen
_fseeki64
feof
_wfreopen
fread
ferror
fputs
getc
ftell
fclose
fseek
rewind
_chsize_s
_wstat64
_wrename
_wfopen
_fileno
_wpopen
_pclose
_wsystem
_waccess
_wremove
_wchdir
_wgetcwd
_chmod
_execvp
_execve
_getpid
signal
_utime64
_stat64
getenv
_strtoui64
atol
atoi
malloc
free
_setjmp
_beginthreadex
_endthreadex
_vsnprintf
vfprintf
strchr
strstr
longjmp
__argc
__wargv
_wenviron
_XcptFilter
__set_app_type
_controlfp
__wgetmainargs

kernel32

SetConsoleOutputCP
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
SetConsoleMode
AddVectoredExceptionHandler
GetLastError
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeLibrary
GetProcAddress
IsDebuggerPresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
CopyFileW
RemoveDirectoryW
ReadConsoleW
ReadFile
GetModuleFileNameW
GetFileAttributesW
CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetFullPathNameW
FindFirstFileW
FindClose
FindNextFileW
CreateDirectoryW
CreatePipe
SetHandleInformation
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateSymbolicLinkW
CreateHardLinkW
GetComputerNameW
GetLongPathNameW
GetModuleHandleA
TerminateProcess
GenerateConsoleCtrlEvent
Sleep
PeekNamedPipe
EnterCriticalSection
LeaveCriticalSection
DebugBreak
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
GetEnvironmentVariableA
GetModuleFileNameA
CreateFileA
SetFilePointer
WriteFile
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualFree
GlobalAlloc
GlobalFree
GetCurrentProcess
GetCurrentThread
DuplicateHandle
GetCurrentThreadId
GetExitCodeThread
SuspendThread
GetThreadContext
ResumeThread
SetLastError
CreateThread
ExitThread
SetUnhandledExceptionFilter

advapi32

GetUserNameW

user32

MessageBoxA

Exports

Exports

__bt_init
tcc_backtrace

Sections

.text
Size: 599KB - Virtual size: 598KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stab
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stabstr
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f40a7690d75d7380b3b21231c6b57d9

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

user32

Exports

Exports

Sections

.text Size: 599KB - Virtual size: 598KB

.data Size: 36KB - Virtual size: 226KB

.pdata Size: 18KB - Virtual size: 18KB

.rdata Size: 8KB - Virtual size: 7KB

.stab Size: 287KB - Virtual size: 287KB

.stabstr Size: 86KB - Virtual size: 85KB

.text
Size: 599KB - Virtual size: 598KB

.data
Size: 36KB - Virtual size: 226KB

.pdata
Size: 18KB - Virtual size: 18KB

.rdata
Size: 8KB - Virtual size: 7KB

.stab
Size: 287KB - Virtual size: 287KB

.stabstr
Size: 86KB - Virtual size: 85KB