es2ts[.]exe | Triage

General

Target

es2ts.exe
Size

172KB
MD5

a6c3eaf388e87535994c8eb563dc83ad
SHA1

ddefede4be58de2f853d3d8f921c8fc0418fb507
SHA256

a691d0c41b6da750678b05e84fd9abeac73b5801519f5137d176c2aa72e5d347
SHA512

deaf7608f4d11a7eb14e7313f6d6806bbec8b5f77f21f2f6a17c29b76ebf7679540841b35611b0d2396a6ddb57846e4572259f82727834409ba2de1ebe6caec1
SSDEEP

3072:16fUaET8YD8yUPNz11/3jRX8t6q9qAg0FuSTt:16fiDDLUVHvjxuwAO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
es2ts.exe

Files

es2ts.exe
.exe windows:4 windows x86

bf207b6c177217d9d13851d61dc9225e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

closesocket
socket
ioctlsocket
gethostbyname
htons
ntohl
setsockopt
connect
WSAStartup
WSACleanup
select
__WSAFDIsSet
recv
send
WSAGetLastError

kernel32

TlsFree
SetEndOfFile
RaiseException
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
Sleep
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
MultiByteToWideChar
ReadFile
HeapReAlloc
GetSystemTimeAsFileTime
CloseHandle
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
InitializeCriticalSection
LoadLibraryA
LCMapStringA
LCMapStringW

Sections

.text
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf207b6c177217d9d13851d61dc9225e

Headers

File Characteristics

Imports

wsock32

kernel32

Sections

.text Size: 112KB - Virtual size: 108KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 8KB - Virtual size: 1.1MB

.text
Size: 112KB - Virtual size: 108KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 8KB - Virtual size: 1.1MB