dummy[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dummy.exe
Size

410KB
MD5

6526291bb57d7215dd35b40447e0c450
SHA1

06674a866c2b996ac782e903299295a0e581a53a
SHA256

ae989e7f6ee563c97ec3faae4fcef7416c71d36ea682d8e6e0f1201520920925
SHA512

52a0383e42fbd0089ae62a3e90922197db909086a47e1257f5b8a434081bc7e3cdf92c2ef90bf8362dc36739751f0d6f7300e65189f3da6c83c2716040afb10e
SSDEEP

12288:mrsFlBLkDsU6F/ZKOV1ml8C/ZF6o1JuSytYJpco:mrsFlBLkDc5ZKaml8C/ZF6oa0Jp9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dummy.exe

Files

dummy.exe
.exe windows:5 windows x86

4b5258e0938e0a221708a3c46cc833b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
GetDiskFreeSpaceExA
GetVolumeInformationA
GetSystemInfo
GetSystemDirectoryA
CreateFileA
DeviceIoControl
CreateEventA
WideCharToMultiByte
lstrlenW
GetCommandLineA
SetLastError
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
LocalFree
FormatMessageA
CompareStringW
InterlockedCompareExchange
CreateFileW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
InterlockedExchange
GetStringTypeW
WriteConsoleW
SetStdHandle
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
SetErrorMode
GetModuleFileNameA
SetFilePointer
ReadFile
LCMapStringW
HeapSize
GetModuleFileNameW
ExitProcess
HeapCreate
IsProcessorFeaturePresent
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetFileTime
GetTickCount
InterlockedExchangeAdd
GetModuleHandleA
WaitForSingleObject
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
ProcessIdToSessionId
Process32Next
LoadLibraryA
FreeLibrary
GlobalMemoryStatus
GetSystemDefaultLangID
GetLocaleInfoA
CreateThread
TerminateThread
CreatePipe
GetStartupInfoA
PeekNamedPipe
GetCurrentDirectoryA
Sleep
MoveFileA
GetDriveTypeA
lstrcmpiA
SetFileTime
MultiByteToWideChar
CopyFileA
SetFileAttributesA
WTSGetActiveConsoleSessionId
GetLastError
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetCurrentProcess
ReadProcessMemory
CloseHandle
DeleteCriticalSection
InterlockedIncrement
GetCPInfo
GetStartupInfoW
GetFileType
GetStdHandle
SetHandleCount
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WriteFile
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSetInformation
HeapReAlloc
DecodePointer
EncodePointer
RtlUnwind
RaiseException
InitializeCriticalSection
GetLocalTime
FreeEnvironmentStringsW
SetEnvironmentVariableA

user32

wsprintfA
GetDesktopWindow
GetCursorPos
ReleaseDC
GetWindowDC
GetWindowRect
SystemParametersInfoA
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
keybd_event
MapVirtualKeyA
mouse_event
CloseDesktop
SwitchDesktop
OpenDesktopA
GetUserObjectInformationA
OpenInputDesktop
PostMessageA
GetClassNameA
FindWindowA
EnumDesktopWindows
SetThreadDesktop
GetThreadDesktop
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
GdiFlush
BitBlt
GetSystemPaletteEntries
CreatePalette
SelectPalette
RealizePalette
GetObjectA
CreateBitmap
SelectObject
SetPixel
GetBitmapBits
DeleteObject
CreateDCA
GetDeviceCaps
DeleteDC
GetDIBits

advapi32

GetSecurityDescriptorDacl
GetTokenInformation
OpenProcessToken
RegCreateKeyA
RegOpenKeyA
CloseServiceHandle
LogonUserA
CreateProcessAsUserA
FreeSid
GetKernelObjectSecurity
ConvertSidToStringSidA
SetEntriesInAclA
MakeAbsoluteSD
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
SetKernelObjectSecurity
AllocateAndInitializeSid
BuildTrusteeWithSidA
DuplicateTokenEx
SetTokenInformation
LookupAccountSidA
RevertToSelf
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
IsTextUnicode

ole32

CoCreateInstance

ws2_32

ntohs
recvfrom
select
socket
listen
bind
setsockopt
htonl
htons
connect
gethostbyname
closesocket
shutdown
send
recv
__WSAFDIsSet
ioctlsocket
inet_ntoa
getpeername
accept
WSACleanup
WSAStartup
inet_addr
gethostname
ntohl
WSAGetLastError
getsockname
WSAIoctl
WSASocketA

Exports

Exports

_ncProxyXll@16

Sections

.text
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b5258e0938e0a221708a3c46cc833b1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

ws2_32

Exports

Exports

Sections

.text Size: 245KB - Virtual size: 245KB

.rdata Size: 125KB - Virtual size: 125KB

.data Size: 21KB - Virtual size: 41KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 245KB - Virtual size: 245KB

.rdata
Size: 125KB - Virtual size: 125KB

.data
Size: 21KB - Virtual size: 41KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB