chgport[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

chgport.exe
Size

44KB
MD5

6e6ef1b4a51b0908370e4b60bc9d8a08
SHA1

97a365606b790be8564fd5069fd90d12a8ec8140
SHA256

4f6c2addf44c3f3b3c261f6e5cb757135f6510ac272b87599a1c587f2222aaf3
SHA512

274fb2b1f13718c1aeb561b048b8fcafe75cfa916f82d28463173a60f4b3249006f6c3b4cf2193227aa2944f943c75e0ad0c9cda77be4fd8b43af305947327f2
SSDEEP

384:Lftd3AXZ8e0g2MThDHxjK6yRJWTUoeRNZ5SngTKj34YjS9BXFsk9+6UW/QW:L+Z8PglTdHBKCUPhYHj32C169

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chgport.exe

Files

chgport.exe
.exe windows:10 windows x64 arch:x64

312892fbbdb240dc5e0852f245418146

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegEnumValueW

user32

LoadStringW

kernel32

SetUnhandledExceptionFilter
QueryDosDeviceW
SetLastError
GetConsoleOutputCP
SetThreadUILanguage
GetLastError
DefineDosDeviceW
HeapSetInformation
GetStdHandle
MultiByteToWideChar
FormatMessageW
LoadLibraryW
WriteConsoleW
RtlCaptureContext
GetModuleHandleW
FreeLibrary
GetFileType
GetCommandLineW
LocalAlloc
LocalFree
VerSetConditionMask
VerifyVersionInfoW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
Sleep
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess

ntdll

NtOpenFile
NtQueryVolumeInformationFile
NtClose
RtlInitUnicodeString

msvcrt

wcschr
free
iswalnum
_wsetlocale
_wcsnicmp
wcsrchr
malloc
_ultoa
wcscat_s
vswprintf_s
vfwprintf
fwprintf
wcstol
wcstoul
_wcsdup
_wcslwr
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
wcscpy_s
_wcsicmp
setlocale
__iob_func
memcpy
memmove
swprintf_s
wprintf
memset

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

312892fbbdb240dc5e0852f245418146

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-registry-l1-1-0

user32

kernel32

ntdll

msvcrt

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 6KB

.pdata Size: 4KB - Virtual size: 600B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 76B

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 4KB - Virtual size: 600B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 76B