ec[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec.exe
Size

1.1MB
MD5

d173ff4ac67fefc1b4556d63e63cecaa
SHA1

876e95d4d5c491d323bdf64891440f0cd467f7e1
SHA256

8f8568adcea4e32722ce9e54059af57b5c54c735f1618ba541dadb477b3440d9
SHA512

c27537ecf4f2f26434318426dd177ad426daafac783cb8b5104c508813c25c234882a1fe48256d8e50b3ce678c9dac874cfa9549762e1a5078189eaa9d74a037
SSDEEP

24576:xhKbxwHPyRcfQXnKjIdcEOTBn/M3fu15:xhKbuHudcRTBn2m1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec.exe

Files

ec.exe
.exe windows:4 windows x86

ce0bb088a4f6592112397932804139ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime
mmioAscend
mmioRead
mmioSeek
timeSetEvent
timeKillEvent
mmioClose
mmioDescend
mmioOpenA
mciSendCommandA

avifil32

AVIFileExit
AVIStreamGetFrame
AVIFileOpenA
AVIFileInit
AVIStreamTimeToSample
AVIStreamRead
AVIStreamRelease
AVIFileRelease
AVIFileGetStream
AVIStreamGetFrameClose
AVIStreamSampleToTime
AVIStreamStart
AVIStreamLength
AVIStreamGetFrameOpen
AVIStreamReadFormat

user32

ClientToScreen
GetClientRect
GetMessageA
GetCursorPos
SetCursorPos
DispatchMessageA
LoadCursorA
RegisterClassA
CreateWindowExA
DestroyWindow
PeekMessageA
LoadIconA
MessageBoxA
GetAsyncKeyState
GetDesktopWindow
GetWindowRect
GetWindowLongA
SetWindowLongA
AdjustWindowRect
DefWindowProcA
ShowWindow
UpdateWindow
SetFocus
EndDialog
SendDlgItemMessageA
GetDlgItem
GetDC
ReleaseDC
DialogBoxParamA
ShowCursor
SetWindowPos

gdi32

GetStockObject
GetTextExtentPoint32A

ole32

CoUninitialize
CoCreateInstance
CoInitialize

decrypt

?CloseFile@@YAXXZ
?PassWord@@YAPAUgeVFile@@PAD_N@Z

msvcrt

_getcwd
fputs
calloc
rand
asctime
time
cos
sin
memmove
localtime
_adjust_fdiv
floor
fmod
toupper
pow
clock
realloc
strrchr
strncat
vsprintf
atan
ceil
_splitpath
strchr
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
srand
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
fgets
strtok
atoi
atof
fclose
fopen
_mbscmp
sscanf
fread
fwrite
exit
_ftol
fabs
acos
atan2
??2@YAPAXI@Z
??3@YAXPAX@Z
free
__CxxFrameHandler
malloc
sprintf
strncpy
strstr
qsort
asin
sqrt
strncmp
atol
_strupr
_strdup
_itoa
_strnicmp
_unlink
_stricmp
_chdir

mfc42

ord5450
ord2044
ord2448
ord6394
ord3663
ord858
ord535
ord800
ord537
ord2764
ord540
ord6383
ord5440
ord860
ord926
ord4202
ord6283
ord6927
ord6929
ord5710
ord6282
ord2515
ord355
ord641
ord4277
ord5683
ord4129
ord5834
ord3177
ord3499

kernel32

Sleep
OutputDebugStringA
FindFirstFileA
QueryPerformanceCounter
MoveFileA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
GetStartupInfoA
GetModuleHandleA
QueryPerformanceFrequency
DeleteFileA
GetFileAttributesA
SetFileTime
SetFileAttributesA
SetEndOfFile
GetFileInformationByHandle
GetFileSize
WriteFile
ReadFile
SetFilePointer
CloseHandle
CreateDirectoryA
CreateFileA
GetLastError
FindClose
FindNextFileA

Sections

.text
Size: 700KB - Virtual size: 699KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 360KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce0bb088a4f6592112397932804139ea

Headers

File Characteristics

Imports

winmm

avifil32

user32

gdi32

ole32

decrypt

msvcrt

mfc42

kernel32

Sections

.text Size: 700KB - Virtual size: 699KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 360KB - Virtual size: 1.0MB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 700KB - Virtual size: 699KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 360KB - Virtual size: 1.0MB

.rsrc
Size: 4KB - Virtual size: 2KB