Pd0x[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Pd0x.exe
Size

1.0MB
MD5

da9ed154c76d0d764bc4d9998965a61a
SHA1

4c0a5eee91d96069232fecba2c7c45af798ebb54
SHA256

684aa1e340df7e94fad06ced01185b94587d523191a868b8ac025d551557bb36
SHA512

3d78be765232522ed1d43b8fc60dcf1be58c2827c7f7128acac29b7f643bd93253ecfcad25ac98b8a4deae900ede8ce793218c4ee83883143c8a255e4b08f8c4
SSDEEP

12288:zRlOpmnjxyg1UCYlCBW+0olBadGvU8vphQXnXrXEAT/n0pKXiLU09:Nogs7+nlBadGvzhQXnXrXt/VA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Pd0x.exe

Files

Pd0x.exe
.exe windows x64

3f40a7690d75d7380b3b21231c6b57d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

memmove
memset
memcpy
__iob_func
fprintf
exit
strerror
strlen
fflush
fwrite
_get_osfhandle
atexit
setbuf
memcmp
qsort
wcslen
_wgetenv
_putenv
_close
_write
_read
_wopen
_errno
_fdopen
_fseeki64
feof
_wfreopen
fread
ferror
fputs
getc
ftell
fclose
fseek
rewind
_chsize_s
_wstat64
_wrename
_wfopen
_fileno
_wpopen
_pclose
_wsystem
_waccess
_wremove
_wchdir
_wgetcwd
_chmod
_execvp
_execve
_getpid
signal
_utime64
_stat64
getenv
_strtoui64
atol
atoi
malloc
free
_setjmp
_beginthreadex
_endthreadex
_vsnprintf
vfprintf
strchr
strstr
longjmp
__argc
__wargv
_wenviron
_XcptFilter
__set_app_type
_controlfp
__wgetmainargs

kernel32

SetConsoleOutputCP
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
SetConsoleMode
AddVectoredExceptionHandler
GetLastError
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeLibrary
GetProcAddress
IsDebuggerPresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
CopyFileW
RemoveDirectoryW
ReadConsoleW
ReadFile
GetModuleFileNameW
GetFileAttributesW
CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetFullPathNameW
FindFirstFileW
FindClose
FindNextFileW
CreateDirectoryW
CreatePipe
SetHandleInformation
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateSymbolicLinkW
CreateHardLinkW
GetComputerNameW
GetLongPathNameW
GetModuleHandleA
TerminateProcess
GenerateConsoleCtrlEvent
Sleep
PeekNamedPipe
EnterCriticalSection
LeaveCriticalSection
DebugBreak
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
GetEnvironmentVariableA
GetModuleFileNameA
CreateFileA
SetFilePointer
WriteFile
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualFree
GlobalAlloc
GlobalFree
GetCurrentProcess
GetCurrentThread
DuplicateHandle
GetCurrentThreadId
GetExitCodeThread
SuspendThread
GetThreadContext
ResumeThread
SetLastError
CreateThread
ExitThread
SetUnhandledExceptionFilter

advapi32

GetUserNameW

user32

MessageBoxA

Exports

Exports

__bt_init
tcc_backtrace

Sections

.text
Size: 602KB - Virtual size: 602KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stab
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stabstr
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f40a7690d75d7380b3b21231c6b57d9

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

user32

Exports

Exports

Sections

.text Size: 602KB - Virtual size: 602KB

.data Size: 36KB - Virtual size: 226KB

.pdata Size: 18KB - Virtual size: 18KB

.rdata Size: 8KB - Virtual size: 7KB

.stab Size: 289KB - Virtual size: 288KB

.stabstr Size: 86KB - Virtual size: 86KB

.text
Size: 602KB - Virtual size: 602KB

.data
Size: 36KB - Virtual size: 226KB

.pdata
Size: 18KB - Virtual size: 18KB

.rdata
Size: 8KB - Virtual size: 7KB

.stab
Size: 289KB - Virtual size: 288KB

.stabstr
Size: 86KB - Virtual size: 86KB