gotoo[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

gotoo.exe
Size

1.0MB
MD5

bcbd4fe9124441facb5069df5d9d52f4
SHA1

8f9c17b6c3a254ed21340b1f4516dc9c108a2149
SHA256

e41d2e1144d76249cedbc811788e7adf4c7f7974b3199fe93652c4bd7471763b
SHA512

076345f4bcc793fea461e5852f25edaa377635b154d1d203ada033d116925b7c228680b55ebfa11eb0bf1fec054de9c8882a8f3704ad8b9ea9e6b83f8b6e4927
SSDEEP

12288:/3KpkG1XnZC+R+7890owOc+fpRR8YBfJ9a4T9zdBEPonzMqcsYVUMTL9DJXMBItB:/3g1JncpXsPhEPWmsYVbTzXM+oC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gotoo.exe

Files

gotoo.exe
.exe windows x64

01e625abea67e09ffdee8f5af099356f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetEnvironmentStringsW
GetEnvironmentVariableW
RtlCaptureContext
GetCurrentThread
GetCommandLineW
DuplicateHandle
GetCurrentProcess
GetCurrentDirectoryW
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
CompareStringOrdinal
ReleaseSRWLockShared
FindClose
ReleaseMutex
GetCurrentProcessId
FreeEnvironmentStringsW
GetCurrentThreadId
WriteFileEx
SleepEx
WaitForSingleObject
InitializeSListHead
TryAcquireSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
GetProcessHeap
HeapFree
RtlVirtualUnwind
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetFileInformationByHandle
GetFileInformationByHandleEx
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FindFirstFileW
WriteConsoleW
GetFileType
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
HeapAlloc
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
SetConsoleTextAttribute
MultiByteToWideChar
CreateThread
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
CreateFileW
GetConsoleMode
SetConsoleMode
GetStdHandle
GetConsoleScreenBufferInfo
GetProcAddress
RtlLookupFunctionEntry
GetModuleHandleA
Sleep
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCursorPosition
SetConsoleCursorInfo
WaitForMultipleObjects
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent

user32

GetWindowThreadProcessId
ToUnicodeEx
GetKeyboardLayout
GetForegroundWindow

advapi32

SystemFunction036

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

bcrypt

BCryptGenRandom

vcruntime140

memset
memcmp
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memcpy
memmove
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
exit
_seh_filter_exe
__p___argc
_initterm_e
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_set_app_type
_get_initial_narrow_environment
_initterm
__p___argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 737KB - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 282KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01e625abea67e09ffdee8f5af099356f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ntdll

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 737KB - Virtual size: 736KB

.rdata Size: 282KB - Virtual size: 282KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 31KB - Virtual size: 31KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 737KB - Virtual size: 736KB

.rdata
Size: 282KB - Virtual size: 282KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 31KB - Virtual size: 31KB

.reloc
Size: 4KB - Virtual size: 3KB