pageant[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pageant.exe
Size

235KB
MD5

9d793fc3721e80d2af8e1c51be8de3c3
SHA1

6d939fd6b65e0c45cb7c1e25ee3549c2e6cf4a94
SHA256

a24d489b8e1ce920bf613a3335f5df16e660c06dfad8ef02eca735cab7cef5f3
SHA512

57a348899fc2b79eabb9a1df292a910e1eee23e40146be717df36f27869d08567b0c4cd594d7abad0dc4ef89cea607a6ff2abb9de01574dadcb8fecebbc86679
SSDEEP

3072:vyrck7aszUbykFmfz5J4j0+qylsxJw3YCTh9tYErNn4PaumtAi1:vy5asMm0wylUJMvThIEZKmtAi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pageant.exe

Files

pageant.exe
.exe windows:5 windows x64

373228ec61ac42a67734a52324f5981b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegEnumKeyA
RegOpenKeyA
CopySid
GetLengthSid
EqualSid
AllocateAndInitializeSid

comdlg32

GetSaveFileNameA
GetOpenFileNameA

gdi32

GetStockObject

shell32

Shell_NotifyIconA
ShellExecuteA

user32

LoadCursorA
RegisterClassA
CreateWindowExA
CreatePopupMenu
CreateMenu
AppendMenuA
SetMenuDefaultItem
GetMessageA
IsWindow
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyMenu
PostQuitMessage
RegisterWindowMessageA
SendMessageA
CreateDialogParamA
ShowWindow
GetMenuItemInfoA
TrackPopupMenu
GetCursorPos
GetMenuDefaultItem
PostMessageA
DefWindowProcA
FindWindowA
RemoveMenu
InsertMenuItemA
LoadIconA
DestroyIcon
GetWindowLongPtrA
SetWindowLongPtrA
GetDlgItem
SendDlgItemMessageA
MessageBeep
GetDesktopWindow
GetWindowRect
MoveWindow
SetForegroundWindow
SetWindowPos
EnableWindow
DialogBoxParamA
SetActiveWindow
DestroyWindow
EndDialog
SetDlgItemTextA
GetActiveWindow
GetLastActivePopup
MessageBoxA
WinHelpA
MessageBoxIndirectA
GetDlgItemTextA
GetMenuItemCount

kernel32

GetProcessHeap
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
HeapSize
Sleep
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwindEx
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
HeapCreate
GetVersion
HeapSetInformation
GetModuleFileNameW
GetStdHandle
WriteFile
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlsAlloc
SetLastError
FlsFree
FlsSetValue
FlsGetValue
FreeLibrary
GetProcAddress
GetModuleFileNameA
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
GetLastError
FormatMessageA
FindClose
FindNextFileA
FindFirstFileA
ExpandEnvironmentStringsA
ReadFile
GetFileSize
SetCurrentDirectoryA
CloseHandle
CreateFileA
GetCurrentDirectoryA
LocalFree
OpenProcess
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
LocalAlloc
GetCurrentThreadId
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapFree
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
GetStartupInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
CreateFileW

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

373228ec61ac42a67734a52324f5981b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comdlg32

gdi32

shell32

user32

kernel32

Sections

.text Size: 160KB - Virtual size: 160KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 6KB - Virtual size: 17KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 160KB - Virtual size: 160KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 6KB - Virtual size: 17KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 2KB - Virtual size: 1KB