at[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

at.exe
Size

28KB
MD5

5fd22b915c232378e567160d641cc9f2
SHA1

ab2909a696991b728f42ffb616c77d8ca4a1a798
SHA256

488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
SHA512

ac59ce4fe3770df0fa2df2ab8c8801ea1a6d4b2c280863e376138cadfbc5287ae67a10634d50ddd9d64b16c6f6d7ffb7aefe3156fe87dc7e862754e7745ee2bf
SSDEEP

768:kMd5AsU2AN1nPPh1592eqYHPBzRQL+pI+8K:HfMVP5172sPrW5+8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
at.exe

Files

at.exe
.exe windows:6 windows x64

aecd0f49bfcf63cdac0d098cda049174

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

kernel32

GetCommandLineW
GetCPInfo
SetThreadUILanguage
ReadConsoleW
WriteFile
WideCharToMultiByte
LoadLibraryW
GetConsoleMode
FormatMessageW
GetTimeFormatW
WriteConsoleW
MultiByteToWideChar
GetConsoleOutputCP
GetStdHandle
GetLastError
GetThreadLocale
GetFileType
HeapSetInformation
LocalFree
GetSystemTime
ExpandEnvironmentStringsW
GetProfileStringA
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetTickCount
LocalAlloc
GetProfileIntA
FreeLibrary
LoadLibraryExW
GetSystemTimeAsFileTime

msvcrt

wcscpy_s
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
_stricmp
??3@YAXPEAX@Z
wcscmp
memset
_itoa_s
strspn
strcpy_s
sscanf
exit
_wcsupr
wcstok_s
_iob
strpbrk
_vsnwprintf
wcsrchr
fgets
strchr
malloc
free
wcstoul
_wcsicmp
wcschr
strcat_s

ntdll

WinSqmIsOptedIn
RtlVirtualUnwind
WinSqmAddToStream
RtlLookupFunctionEntry
RtlCaptureContext

netutils

NetApiBufferFree

schedcli

NetScheduleJobEnum
NetScheduleJobDel
NetScheduleJobGetInfo
NetScheduleJobAdd

shell32

CommandLineToArgvW

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aecd0f49bfcf63cdac0d098cda049174

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

netutils

schedcli

shell32

Sections

.text Size: 17KB - Virtual size: 16KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 1024B - Virtual size: 636B

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 208B

.text
Size: 17KB - Virtual size: 16KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 1024B - Virtual size: 636B

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 208B