Step_One[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Step_One.exe
Size

8KB
MD5

392d8d44e84212ff4972304b2558c0e3
SHA1

6c2c00395a405b6215a45b03ce7179dedf5407aa
SHA256

c29acaf85f45efcfddc025a408f5fff4cd4fb514d165993f2f7d070a0af11df4
SHA512

409cfca5b7ad62d3efee79cf0fceb09969f74ffe6a88e98c22ab84447114e7cb344eb3665cc450aeacffd4a1ec5b79cf05df96ea92cf9b9949b36a2be1d88f34
SSDEEP

48:yld2x/1CiHY968KiBGD8DpvVw0MESBDRItrNkmDzrm1sFhATnV5cdsSMENssQ88X:Nx9Ec0BygDQESzIthkomyMZ1d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Step_One.exe

Files

Step_One.exe
.exe windows:4 windows x86

1624bac3ccbf1cde59ae1ef7a14b3389

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

PostQuitMessage
RegisterClassExA
ShowWindow
TranslateMessage
UpdateWindow
GetClassLongA
GetClassNameA
LoadIconA
GetParent
IsWindow
SendDlgItemMessageA
SendMessageA
SetTimer
WindowFromPoint
LoadCursorA
GetMessageA
DispatchMessageA
DefWindowProcA
GetCursorPos
CreateWindowExA

gdi32

CreateSolidBrush

kernel32

ExitProcess
GetModuleHandleA
RtlZeroMemory

Sections

.text
Size: 1024B - Virtual size: 846B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ