gspawn-win32-helper-console[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

gspawn-win32-helper-console.exe
Size

22KB
MD5

73e5c14b5f9b87232d9c8293e032aabb
SHA1

db222b010bff1d71dbde56ad2f16e8bc9de2fcdf
SHA256

07662f7d22205887107bb40b4648e5be5c3e641cb7327609c9c19c1094c71e5a
SHA512

757810b08e31cc235c6ea88c3bbcd396536e8646c87edd7eab15c52512dc3863c15f400f2d0514597e09e00396ad98603e2adf361be879787bd346f86fdfe484
SSDEEP

192:9Jj4FkWahnhwerpak8nvKp7YET3Nk4XrhL2rjr7gNN7Vl1RuKw1:fwkDNhwerpakh0odxhyD709VlbuB1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gspawn-win32-helper-console.exe

Files

gspawn-win32-helper-console.exe
.exe windows:4 windows x86

d5ae9ae0bf429e0381b867935ca84ba4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libglib-2.0-0

g_assertion_message_expr
g_malloc

kernel32

AddAtomA
DuplicateHandle
ExitProcess
FindAtomA
GetAtomNameA
GetCurrentProcess
SetUnhandledExceptionFilter

msvcrt

_close
_dup2
_open
_read
_write
__getmainargs
__p___argc
__p___argv
__p__environ
__p__fmode
__set_app_type
__wgetmainargs
_assert
_cexit
_errno
_exit
_get_osfhandle
_iob
_onexit
_open_osfhandle
_setmode
_wchdir
_wspawnv
_wspawnvp
abort
atexit
atoi
free
malloc
memset
signal
strlen

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 180B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE