taskkill[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

taskkill.exe
Size

99KB
MD5

a599d3b2fafbde4c1a6d7d0f839451c7
SHA1

0225bbec16cb7b23b189f811065767180eda9801
SHA256

56f8cc2c1790c389394733b84c3fb55e10977e9f0fe0c08110ac11f0fe47f05e
SHA512

acfd16b245a667c3766d36ea753aa7002a03c206b7c3117ccac92315401b536f56ceff606d8112178dd8916a20378ab91818e0e65e6ccfd5d75955f511d6fbfb
SSDEEP

1536:mr0UyaEu4C1f5FJHLK9eHckIe5VZ67IrujQR4I+9TrxxIzN:y0UBEu4kNysIe5V8MCj5xxIB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
taskkill.exe

Files

taskkill.exe
.exe windows:10 windows x64

71212588549fb37a46c8556278f180cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegConnectRegistryW
RegCloseKey
LookupAccountSidW
OpenSCManagerW
EnumServicesStatusExW
CloseServiceHandle
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

kernel32

OpenProcess
CloseHandle
GetExitCodeProcess
TerminateProcess
WriteConsoleW
GetStdHandle
LocalAlloc
FormatMessageW
FreeLibrary
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
GetCurrentProcess
SetLastError
GetModuleFileNameW
GetComputerNameExW
GetLastError
HeapReAlloc
HeapAlloc
HeapValidate
HeapFree
GetProcessHeap
ReadConsoleW
ReadFile
SetConsoleMode
MultiByteToWideChar
GetConsoleOutputCP
ExitProcess
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
GetConsoleMode
GetFileType
WideCharToMultiByte
VerSetConditionMask
SetThreadUILanguage
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LocalFree
GetCurrentThreadId
HeapSize

msvcrt

wcstok
wcsstr
_CxxThrowException
memcpy
fflush
fprintf
_get_osfhandle
_fileno
wcstol
wcstod
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
_errno
wcstoul
wcschr
_wtoi64
_wcsicmp
wcsrchr
_wcsdup
free
__CxxFrameHandler3
__iob_func
_memicmp
_vsnwprintf
memset

ntdll

RtlVirtualUnwind
RtlTimeToElapsedTimeFields
RtlLargeIntegerToChar
RtlLookupFunctionEntry
RtlCaptureContext
RtlVerifyVersionInfo

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

user32

CharUpperW
GetWindowThreadProcessId
FindWindowExW
EnumWindows
CloseDesktop
SetThreadDesktop
LoadStringW
GetThreadDesktop
EnumDesktopsW
CloseWindowStation
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
EnumWindowStationsW
wsprintfW
GetWindowLongW
PostMessageW
GetWindowTextW
IsHungAppWindow
GetWindow
OpenDesktopW

mpr

WNetAddConnection2W
WNetCancelConnection2W
WNetGetLastErrorW

oleaut32

VariantCopy
SysStringLen
SysAllocStringByteLen
VariantInit
SysFreeString
SysAllocString
VariantChangeType
VariantClear

ws2_32

WSAGetLastError
GetAddrInfoW
FreeAddrInfoW
WSACleanup
GetNameInfoW
WSAStartup

framedynos

??YCHString@@QEAAAEBV0@PEBG@Z
?GetData@CHString@@IEBAPEAUCHStringData@@XZ
?Empty@CHString@@QEAAXXZ
?Mid@CHString@@QEBA?AV1@HH@Z
?Compare@CHString@@QEBAHPEBG@Z
?Mid@CHString@@QEBA?AV1@H@Z
?Find@CHString@@QEBAHG@Z
?FindOneOf@CHString@@QEBAHPEBG@Z
??4CHString@@QEAAAEBV0@PEBD@Z
??YCHString@@QEAAAEBV0@AEBV0@@Z
??1CHString@@QEAA@XZ
??0CHString@@QEAA@XZ
?ReleaseBuffer@CHString@@QEAAXH@Z
?GetBufferSetLength@CHString@@QEAAPEAGH@Z
?GetBuffer@CHString@@QEAAPEAGH@Z
?Left@CHString@@QEBA?AV1@H@Z
?Format@CHString@@QEAAXPEBGZZ
??4CHString@@QEAAAEBV0@AEBV0@@Z
??4CHString@@QEAAAEBV0@PEBG@Z

dbghelp

EnumerateLoadedModulesW64

shlwapi

StrStrIW
StrStrW
StrChrW
StrChrIW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoInitializeSecurity

sspicli

GetUserNameExW

srvcli

NetServerGetInfo

netutils

NetApiBufferFree

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71212588549fb37a46c8556278f180cd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

version

user32

mpr

oleaut32

ws2_32

framedynos

dbghelp

shlwapi

api-ms-win-core-com-l1-1-0

sspicli

srvcli

netutils

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 48B

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 48B