help[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

help.exe
Size

138KB
MD5

5a1826d07cc52c493e354dc1f242bfb3
SHA1

bf7e7bce593cbfa03c60fe775c78bf6d663f92bb
SHA256

02d0339606eaacf6f1fadaa2b131e96d3c12dcbc904d9148faf2156a9e93c7eb
SHA512

e76c7dd4ac4bd3c34df74ee4a51bb51035b2c8a3e786f6582d9804ed4d91aa23e85ba87dd26095d4703f97e2389c1360b5a477b19be5dc374aa424928856b93d
SSDEEP

3072:502GNXzQ5qs94jzULQ62osTbkZlzZxciTAVpvctlE57Px9:502sXzQ7k4Lh2lbIzkiM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
help.exe

Files

help.exe
.exe windows:6 windows x86

022c6fad6b8cc63f97bc4ada6fb50002

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
WaitForMultipleObjectsEx
WaitForSingleObject
SetEvent
WaitForSingleObjectEx
CloseHandle
QueueUserAPC
SleepEx
GetSystemTimeAsFileTime
CreateEventA
MultiByteToWideChar
ResetEvent
WideCharToMultiByte
GetStdHandle
GetTickCount
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
DecodePointer

user32

wsprintfA

ws2_32

WSASend
listen
getpeername
getsockname
socket
GetAddrInfoW
WSARecv
getsockopt
WSAGetOverlappedResult
WSAIoctl
WSAGetLastError
htonl
WSACleanup
closesocket
WSAStartup
inet_addr
ntohl
ntohs
inet_ntop
htons
getnameinfo
FreeAddrInfoW
bind
setsockopt

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

022c6fad6b8cc63f97bc4ada6fb50002

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ws2_32

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 2KB - Virtual size: 5KB

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 2KB - Virtual size: 5KB