passwd[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

passwd.exe
Size

160KB
MD5

3bbc46cb9d40677884897ed6a4166926
SHA1

924887d25d4778eb94d7050be542bd22daae88ed
SHA256

cafb6d1b5cc9be48accdabd656dbae9ad376cc9293fa4601c7e174d861e665d7
SHA512

f8f663ea3f5b46bb6d7463795bb98c7501a82a0600f405994bbc61ff0e321836fb0c5a6c97d1aee780fdc8c3c319fcf34d649ea96407d774b5878d54e443c8f0
SSDEEP

3072:fZVR5cckchUgv1K2Ai59majLn0aTqWA3xq4B4bRKoP:nHwcXtxAo9zn9TqiR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
passwd.exe

Files

passwd.exe
.exe windows:4 windows x86

6c53bf61a87730a4e84c9de764976517

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
RaiseException
HeapFree
IsBadReadPtr
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
LCMapStringA
LCMapStringW
GetCPInfo
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
GetModuleFileNameA
VirtualFree
WriteFile
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
VirtualAlloc
IsBadWritePtr
GetLastError
SetFilePointer
FlushFileBuffers
CloseHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetStringTypeA
GetStringTypeW
IsBadCodePtr
GetACP
GetOEMCP
LoadLibraryA
ReadFile
SetStdHandle
GetLocaleInfoW

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE