HiddenStuff[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

HiddenStuff.exe
Size

13.1MB
MD5

4da03d1d314d2d055d03f88dfdb251a5
SHA1

ac83932447fc3e9fe437c125d426906e7161f86e
SHA256

467d17930b6405bb5f985c910bce71401b9b4efbeccf7044ad9a572099511468
SHA512

54578fa2213757421c642543006879b94fbfd5bd74159149d1a4ce6a7a15b6f32a3ad4accfdb7511d330fd97f30f44e59a846e484b04a8558ce34fd0019e6333
SSDEEP

196608:yyrlF8wqw0DLRl1viYhzhauUraPVkgrYvbq4uDa416AjOdZgvb4uy1L0Hwes:yyrlFwDtXjhEd7vbqraGzOTgvbI0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HiddenStuff.exe

Files

HiddenStuff.exe
.exe windows:6 windows x64 arch:x64

8ad732f1414be1850a860653d90de87f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateToolhelp32Snapshot

user32

GetWindowLongW

msvcp140

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

ntdll

RtlVirtualUnwind

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-stdio-l1-1-0

fsetpos

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.=/R
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ZVe
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IjW
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 254KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ad732f1414be1850a860653d90de87f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: - Virtual size: 30KB

.rdata Size: - Virtual size: 18KB

.data Size: - Virtual size: 9.1MB

.pdata Size: - Virtual size: 2KB

.=/R Size: - Virtual size: 2.4MB

.ZVe Size: 3KB - Virtual size: 3KB

.IjW Size: 12.9MB - Virtual size: 12.9MB

.reloc Size: 512B - Virtual size: 244B

.rsrc Size: 254KB - Virtual size: 253KB

.text
Size: - Virtual size: 30KB

.rdata
Size: - Virtual size: 18KB

.data
Size: - Virtual size: 9.1MB

.pdata
Size: - Virtual size: 2KB

.=/R
Size: - Virtual size: 2.4MB

.ZVe
Size: 3KB - Virtual size: 3KB

.IjW
Size: 12.9MB - Virtual size: 12.9MB

.reloc
Size: 512B - Virtual size: 244B

.rsrc
Size: 254KB - Virtual size: 253KB